Code Explainers

Code explainers tagged #security

go 
package httputil
 
import (
	"net"

Safely extracting the real client IP in Go

security http ip-spoofing
Intermediate 7 steps
rust 
use axum::{
    body::Body,
    extract::Request,
    http::{header, StatusCode},

A CSRF verification middleware in Axum

csrf middleware security
Intermediate 10 steps
ruby 
module MarkdownHelper
  ALLOWED_TAGS = %w[
    p br strong em del a ul ol li blockquote code pre
    h1 h2 h3 h4 h5 h6 hr img table thead tbody tr th td

Safely rendering Markdown in a Rails helper

sanitization markdown security
Intermediate 8 steps
ruby 
require "yaml"
require "date"
 
class Money

Custom YAML serialization in Ruby

serialization yaml custom-encoding
Intermediate 7 steps
php 
<?php
 
namespace App\Services;
 

Throttling login attempts in Laravel

rate-limiting authentication security
Intermediate 6 steps
python 
import bleach
 
ALLOWED_TAGS = [
    "a", "b", "strong", "i", "em", "u",

Sanitizing user HTML with bleach

sanitization xss-prevention whitelisting
Intermediate 5 steps
javascript 
const express = require('express');
const cors = require('cors');
 
const app = express();

Configuring a CORS allowlist in Express

cors middleware security
Intermediate 8 steps
go 
package storage
 
import (
	"errors"

Preventing path traversal in Go

path-traversal input-validation security
Intermediate 9 steps
ruby 
class ApplicationController < ActionController::Base
  INACTIVITY_TIMEOUT = 30.minutes
 
  before_action :expire_stale_session

Idle session timeout in a Rails controller

authentication session-management before-action
Intermediate 6 steps
go 
package handlers
 
type WebhookEvent struct {
	ID   string          `json:"id"`

Verifying and processing webhooks in Gin

webhooks hmac idempotency
Intermediate 9 steps
javascript 
const express = require('express');
 
const app = express();
 

Enforcing HTTPS with Express middleware

middleware https security
Intermediate 6 steps
php 
<?php
 
final class RememberMeCookie
{

Signed remember-me cookies in PHP

authentication hmac cookies
Intermediate 8 steps
ruby 
class WebhookSignatureConstraint
  def initialize(provider)
    @provider = provider
  end

Verifying webhook signatures with Rails routing constraints

routing constraints hmac webhooks
Advanced 7 steps
javascript 
const MAX_FILE_SIZE = 5 * 1024 * 1024;
 
const ALLOWED_TYPES = {
  'image/jpeg': ['jpg', 'jpeg'],

Validating file uploads by content, not just claims

input-validation security magic-bytes
Intermediate 7 steps
python 
from fastapi import FastAPI, Request, status
from fastapi.encoders import jsonable_encoder
from fastapi.exceptions import RequestValidationError
from fastapi.responses import JSONResponse

Redacting sensitive fields in FastAPI errors

validation error-handling security
Intermediate 7 steps
ruby 
class ApplicationController < ActionController::Base
  ALLOWED_REDIRECT_HOSTS = [nil, ENV.fetch("APP_HOST", "app.example.com")].freeze
 
  def store_return_to(location = request.fullpath)

Safe post-login redirects in Rails

open-redirect session authentication
Intermediate 9 steps
typescript 
import { Exclude, Expose, Transform, Type } from 'class-transformer';
 
export class AddressEntity {
  street: string;

Shaping API responses with class-transformer in NestJS

serialization decorators dto
Intermediate 10 steps
javascript 
const express = require('express');
const cookieParser = require('cookie-parser');
 
const router = express.Router();

Remember-me login with signed cookies in Express

authentication signed-cookies sessions
Intermediate 9 steps