codesnips

security

ruby 
Rails.application.config.middleware.insert_before 0, Rack::Cors do
  # Development CORS - allow any localhost
  allow do
    origins(
      /http:\/\/localhost:\d+/,
      /http:\/\/127\.0\.0\.1:\d+/,

CORS configuration for Rails APIs

rails cors security
by Maya Patel 1 tab
php 
<?php

namespace App\Dto;

use Symfony\Component\HttpFoundation\File\UploadedFile;
use Symfony\Component\Validator\Constraints as Assert;

Symfony Avatar Upload: Constrained Form Type, Image Validation, and an Uploader Service

symfony forms validation
by codesnips 4 tabs
javascript 
const jwt = require('jsonwebtoken');

const ACCESS_SECRET = process.env.JWT_ACCESS_SECRET;
const REFRESH_SECRET = process.env.JWT_REFRESH_SECRET;
const ISSUER = 'api.example.com';
const AUDIENCE = 'example-web';

Sign and Verify JWT Access Tokens in Express Auth Middleware

express jwt authentication
by codesnips 3 tabs
ruby 
module ApplicationCable
  class Connection < ActionCable::Connection::Base
    identified_by :current_user

    def connect
      self.current_user = find_verified_user

ActionCable channel that streams Turbo updates safely

rails hotwire turbo
by codesnips 4 tabs
python 
import threading
from contextlib import contextmanager

_state = threading.local()

Per-Tenant Data Isolation in Django with a Thread-Local Current Tenant Manager

django multi-tenancy orm
by codesnips 4 tabs
go 
package session

import (
	"crypto/hmac"
	"crypto/sha256"
	"encoding/base64"

Stateless Session Cookies Signed and Verified With HMAC in Go

go security cookies
by codesnips 3 tabs
ruby 
require "loofah"

class HtmlSanitizer
  ALLOWED_TAGS  = %w[p br a strong em ul ol li blockquote code pre h2 h3].freeze
  ALLOWED_ATTRS = %w[href title].freeze
  SAFE_SCHEMES  = %w[http https mailto].freeze

Safer HTML Sanitization Pipeline

rails security xss
by codesnips 4 tabs
go 
package web

import (
  "bytes"
  "html/template"
  "net/http"

Template rendering with html/template and strict escaping

go templates http
by Leah Thompson 1 tab
javascript 
const jwt = require('jsonwebtoken');

const SECRET = process.env.JWT_SECRET;
const ALGORITHM = 'HS256';
const ACCESS_TTL = '15m';

JWT Authentication Middleware in Express That Populates req.user

express jwt authentication
by codesnips 3 tabs
ruby 
module Webhooks
  class StripeController < ApplicationController
    skip_before_action :verify_authenticity_token

    def create
      payload = request.body.read

Webhook signature verification

rails security webhooks
by Alex Kumar 1 tab
java 
import org.springframework.data.jpa.repository.JpaRepository;
import org.springframework.data.jpa.repository.Modifying;
import org.springframework.data.jpa.repository.Query;
import org.springframework.data.repository.query.Param;

import java.time.Instant;

Nightly Cleanup of Expired Refresh Tokens with Spring @Scheduled and a Bulk Delete Query

spring-boot scheduling cron
by codesnips 4 tabs
python 
import hashlib
import hmac
import time


class SignatureError(Exception):

Verify Stripe-Style Webhook HMAC Signatures Before Processing in Flask

flask webhooks hmac
by codesnips 3 tabs