Security
2 items
- Note CORS Is Not Security (and Your Rate Limiter Probably Isn't Global) CORS only tells browsers what they may read, and the built-in rate limiter counts per instance. Both work in the demo and leak in production once you forget which assumption you were making.3 min
- Note 403 or 404, and Other Authorization Calls to Make on Purpose A 403 tells the caller the thing exists. Which status you return on a denial, where identity comes from, and whether endpoints depend on how roles are issued are all decisions most APIs make by default.3 min