Tag
security
Published articles tagged security.
Authentication and authorization in GraphQL
GraphQL needs identity in context and authorization at field granularity. This chapter covers transport auth, resolver and field guards, NestJS GqlExecutionContext, node(id) IDOR risks, and subscription connection_init.
Authentication in MongoDB
MongoDB separates who you are from what you may do. Authentication verifies identity with SCRAM; authorization assigns roles on databases and collections. This page covers users, built-in roles, connection strings, Docker bootstrap credentials, and Atlas database users from application code.
Authentication in NestJS
NestJS authentication is built from guards: one checks a password and issues a token, another verifies that token on every later request. This chapter wires Passport's local and JWT strategies into a Nest app, then protects every route by default with a global guard and a @Public() opt-out.
Authorization in NestJS
Once a NestJS request has a user, authorization decides what that user may do. This chapter builds role checks from a typed decorator and a guard, orders them after authentication, adds a @CurrentUser() parameter, and moves ownership checks into the service where the data is.
Guards in NestJS
A guard answers one question before a NestJS handler runs: may this request continue? This chapter covers the CanActivate contract, reading the request and the handler from the ExecutionContext, steering a guard with metadata, and binding guards to routes or to the whole application.
IAM in Google Cloud
Cloud IAM decides who can call which API on which resource. This chapter covers principals, roles, allow policies, service accounts, and least privilege, then creates deployer and runtime identities for the series file API.
Limiting query depth and cost
Depth limits, complexity analysis, alias caps, timeouts, persisted query allowlists, and disabling introspection protect GraphQL from expensive operations. This chapter shows NestJS complexity plugins and gateway-level controls.
Linux security primitives
Beyond file modes, Linux isolates and constrains processes with capabilities, namespaces, cgroups, seccomp, and mandatory access control. This overview explains AppArmor on Debian, SELinux elsewhere, and how containers combine these kernel features.
Protecting services with Cloud Armor
Cloud Armor attaches WAF rules and rate limits to Google Cloud external load balancers. This chapter fronts the series Cloud Run service with an HTTPS load balancer and a security policy.
Securing GraphQL APIs
A single /graphql endpoint concentrates power and risk. This overview maps GraphQL-specific threats—introspection, deep queries, alias abuse, CSRF, and verbose errors—to controls you should layer at the gateway and in resolvers.
Stripe API keys and the Node.js SDK
Publishable keys belong in the browser, secret and restricted keys stay on the server, and every call goes through a Stripe client instance. This chapter shows how to wire the official stripe npm package into Express, pin an API version, and handle idempotency and errors safely.
Users, groups and permissions in Linux
Every process runs as a user with group memberships and file mode bits. This overview covers UIDs and GIDs, passwd and shadow, rwx and umask, special bits, ACLs, sudo, and PAM on Debian.
Webhooks in Stripe
Webhooks deliver signed Event objects when payments and subscriptions change. Your Express handler verifies signatures, stays idempotent, and fulfills orders there—not on the success page. This chapter covers routing, key events, and local testing with the Stripe CLI.
AI and data privacy
Every prompt sends data somewhere. This overview follows that data: where it goes, how long it is kept, whether it trains future models, and what data protection law requires. It ends with practical rules for people and companies that want to use AI without leaking personal or confidential information.
AI safety and risks
The risks of AI range from a chatbot inventing a fact to fears about systems that people can no longer control. This overview sorts the risks into groups, explains each in plain terms, and describes what companies, governments, and users do about them, including the open debate about human-level AI.
VPC networks in Google Cloud
A VPC network is your private address space in GCP: subnets, routes, firewalls, NAT, and peering. This chapter maps those pieces on Google Cloud, including Direct VPC egress for Cloud Run.
JWT, JWS, JWE, and JOSE
JOSE is the specification family for signing and encrypting a set of claims in a URL-safe token. This page separates JWT, JWS, JWE, and JWK, shows how the compact forms are assembled, and lists the checks a recipient makes before trusting those claims.