codesnips

middleware

ruby 
Rails.application.config.content_security_policy do |policy|
  policy.default_src :self
  policy.font_src    :self, :https, :data
  policy.img_src     :self, :https, :data, "https://cdn.example.com"
  policy.object_src  :none
  policy.script_src  :self, :https

Content Security Policy (CSP) Starter

rails security csp
by codesnips 3 tabs
go 
package middleware

import (
  "compress/gzip"
  "net/http"
  "strings"

Gzip compression middleware with correct Vary header

go http middleware
by Leah Thompson 1 tab
typescript 
import crypto from 'crypto';

interface VerifyOptions {
  rawBody: Buffer;
  signatureHeader: string | undefined;
  secret: string;

Webhook signature verification (timing-safe compare)

security webhooks hmac
by codesnips 3 tabs
typescript 
import { JSDOM } from 'jsdom';
import createDOMPurify, { DOMPurifyI } from 'dompurify';

const { window } = new JSDOM('');
const DOMPurify: DOMPurifyI = createDOMPurify(window as unknown as Window);

Sanitize user HTML safely (DOMPurify + JSDOM)

security html dompurify
by codesnips 2 tabs
ruby 
Rails.application.config.filter_parameters += [
  :password,
  :password_confirmation,
  :secret,
  :token,
  :api_key,

Sensitive Param Filtering for Logs

rails security logging
by codesnips 4 tabs
typescript 
export class AppError extends Error {
  public readonly statusCode: number;
  public readonly code: string;
  public readonly isOperational: boolean;

  constructor(message: string, statusCode = 500, code = 'INTERNAL_ERROR', isOperational = true) {

Backend: normalize errors with a single Express handler

express error-handling typescript
by codesnips 4 tabs
php 
<?php

namespace App\Http\Controllers;

use App\Jobs\ProcessWebhook;
use App\Support\WebhookSignature;

Debounce Duplicate Webhooks in Laravel by Dispatching a Delayed Queued Job

laravel webhooks queues
by codesnips 3 tabs
javascript 
const crypto = require('crypto');

function computeSignature(secret, timestamp, payload) {
  return crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${payload}`, 'utf8')

Verify Stripe-Style Webhook Signatures With HMAC in Express Before Processing

webhooks hmac security
by codesnips 2 tabs
php 
<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

Laravel middleware for request filtering

laravel middleware http
by Carlos Mendez 3 tabs
python 
import time
import threading
from collections import deque, defaultdict


class SlidingWindowLimiter:

Sliding-Window Rate Limiting in Flask With a Custom Decorator and In-Memory Buckets

flask rate-limiting decorators
by codesnips 3 tabs
ruby 
class Current < ActiveSupport::CurrentAttributes
  attribute :user, :tenant, :request_id, :ip_address

  def user_display
    user&.email || "system"
  end

CurrentAttributes for Request-Scoped Context

rails activesupport currentattributes
by codesnips 4 tabs
lua 
-- KEYS[1] = current window key, KEYS[2] = previous window key
-- ARGV: limit, window_ms, elapsed_ms
local limit = tonumber(ARGV[1])
local window = tonumber(ARGV[2])
local elapsed = tonumber(ARGV[3])

Sliding-Window Rate Limiting for Express Routes Backed by Redis

express redis rate-limiting
by codesnips 4 tabs