codesnips

security

ruby 
module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user

    def connect
      self.current_user = find_verified_user

ActionCable channel that streams Turbo updates safely

rails hotwire turbo
by codesnips 4 tabs
python 
import threading
from contextlib import contextmanager

_state = threading.local()

Per-Tenant Data Isolation in Django with a Thread-Local Current Tenant Manager

django multi-tenancy orm
by codesnips 4 tabs
go 
package session

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"

Stateless Session Cookies Signed and Verified With HMAC in Go

go security cookies
by codesnips 3 tabs
typescript 
import { Exclude, Expose } from 'class-transformer';

export class User {
  id: string;

  firstName: string;

Hide Sensitive Fields in NestJS Responses with class-transformer and ClassSerializerInterceptor

nestjs class-transformer serialization
by codesnips 3 tabs
ruby 
require "loofah"

class HtmlSanitizer
  ALLOWED_TAGS  = %w[p br a strong em ul ol li blockquote code pre h2 h3].freeze
  ALLOWED_ATTRS = %w[href title].freeze
  SAFE_SCHEMES  = %w[http https mailto].freeze

Safer HTML Sanitization Pipeline

rails security xss
by codesnips 4 tabs
go 
package web

import (
  "bytes"
  "html/template"
  "net/http"

Template rendering with html/template and strict escaping

go templates http
by Leah Thompson 1 tab
java 
public class PayloadLimitFilter extends OncePerRequestFilter {

    private final long maxBytes;
    private final Set<String> allowedTypes;

    public PayloadLimitFilter(long maxBytes, Set<String> allowedTypes) {

Enforce Request Payload Size and Content-Type with a Servlet Filter and Controller Guard

spring-boot servlet-filter validation
by codesnips 4 tabs
javascript 
const jwt = require('jsonwebtoken');

const SECRET = process.env.JWT_SECRET;
const ALGORITHM = 'HS256';
const ACCESS_TTL = '15m';

JWT Authentication Middleware in Express That Populates req.user

express jwt authentication
by codesnips 3 tabs
javascript 
const jwt = require('jsonwebtoken');

function authenticate(req, res, next) {
  const header = req.headers.authorization || '';
  const [scheme, token] = header.split(' ');

Role-Based Access Control in Express with a requireRole Middleware Factory

express middleware rbac
by codesnips 3 tabs
ruby 
module Webhooks
  class StripeController < ApplicationController
    skip_before_action :verify_authenticity_token

    def create
      payload = request.body.read

Webhook signature verification

rails security webhooks
by Alex Kumar 1 tab
java 
import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.data.jpa.repository.Modifying;
import org.springframework.data.jpa.repository.Query;
import org.springframework.data.repository.query.Param;

import java.time.Instant;

Nightly Cleanup of Expired Refresh Tokens with Spring @Scheduled and a Bulk Delete Query

spring-boot scheduling cron
by codesnips 4 tabs
python 
import hashlib
import hmac
import time


class SignatureError(Exception):

Verify Stripe-Style Webhook HMAC Signatures Before Processing in Flask

flask webhooks hmac
by codesnips 3 tabs