codesnips

security

ruby 
# app/policies/post_policy.rb
class PostPolicy < ApplicationPolicy
  class Scope < Scope
    def resolve
      if user.admin?
        scope.all

Pundit for authorization and policy objects

ruby rails pundit
by Sarah Mitchell 2 tabs
ruby 
require 'sinatra/base'
require 'json'
require_relative 'signature_verifier'

class WebhookApp < Sinatra::Base
  configure do

Verifying Stripe Webhook Signatures in Sinatra with a before Filter

sinatra webhooks stripe
by codesnips 2 tabs
javascript 
const crypto = require('crypto');

function computeSignature(secret, timestamp, payload) {
  return crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${payload}`, 'utf8')

Verify Stripe-Style Webhook Signatures With HMAC in Express Before Processing

webhooks hmac security
by codesnips 2 tabs
java 
@MappedSuperclass
@FilterDef(
    name = "tenantFilter",
    parameters = @ParamDef(name = "tenantId", type = String.class)
)
@Filter(name = "tenantFilter", condition = "tenant_id = :tenantId")

Enforce Multi-Tenant Row Isolation With Hibernate @Filter Enabled Per Request in Spring Boot

spring-boot hibernate jpa
by codesnips 4 tabs
java 
package com.example.security;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

Resolve the Authenticated User into a Controller Argument in Spring Boot

spring-boot spring-mvc security
by codesnips 4 tabs
bash 
#!/usr/bin/env bash
set -euo pipefail

# Container Registry Management & Image Lifecycle

# ============================================

Container registry management and image lifecycle

docker registry ecr
by Ryan Nakamura 1 tab
java 
package com.example.security;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

Method-Level Role Authorization with a Custom @RequireRole Annotation and Spring AOP

spring spring-boot aop
by codesnips 4 tabs
ruby 
class Comment < ApplicationRecord
  belongs_to :account
  belongs_to :author, class_name: "User"

  validates :body, presence: true

Per-account stream scoping to prevent “cross-tenant” updates

rails hotwire turbo-streams
by codesnips 4 tabs
ruby 
require "sinatra/base"
require "rack/utils"

class AdminApp < Sinatra::Base
  before do
    protected!

Protecting Namespaced Admin Routes in Sinatra with an HTTP Basic Auth before Filter

sinatra http-basic-auth authentication
by codesnips 3 tabs
ruby 
user = User.find_by(email: params[:email].to_s.downcase.strip)

if user
  raw_token = SecureRandom.urlsafe_base64(32)
  user.password_resets.create!(token_digest: Digest::SHA256.hexdigest(raw_token), expires_at: 30.minutes.from_now)
  PasswordResetMailer.with(user: user, token: raw_token).deliver_later

Password reset flow that avoids user enumeration and token leaks

password-reset account-enumeration authentication
by Kai Nakamura 1 tab
python 
import json
import secrets
import time
from typing import Optional

import redis.asyncio as redis

Sliding-Window Session Token Expiry With FastAPI Middleware and Redis

fastapi redis sessions
by codesnips 3 tabs
typescript 
const rawOrigins = process.env.ALLOWED_ORIGINS ?? "";

export const allowedOrigins = new Set(
  rawOrigins
    .split(",")
    .map((o) => o.trim())

CORS configuration that’s explicit (no *)

security http express
by codesnips 3 tabs