allowlist

import { createHash } from "crypto";
import { readFileSync } from "fs";

export function sha256(query: string): string {
  return createHash("sha256").update(query, "utf8").digest("hex");
}

GraphQL persisted queries (hash allowlist)

graphql security performance

by codesnips 3 tabs

typescript

const rawOrigins = process.env.ALLOWED_ORIGINS ?? "";

export const allowedOrigins = new Set(
  rawOrigins
    .split(",")
    .map((o) => o.trim())

CORS configuration that’s explicit (no *)

security http express

by codesnips 3 tabs