[ 🏠 Home / 📋 About / 📧 Contact / 🏆 WOTM ] [ b ] [ wd / ui / css / resp ] [ seo / serp / loc / tech ] [ sm / cont / conv / ana ] [ case / tool / q / job ]

/q/ - Q&A Central

Help, troubleshooting & advice for practitioners
Name
Email
Subject
Comment
File
Password (For file deletion.)

File: 1784704685769.jpg (180.3 KB, 1024x1024, img_1784704677890_9h2xhcke.jpg)ImgOps Exif Google Yandex

6165b No.1991

found a bug where users could see everyone's project data because of some broken logic in the rbac layer. i finally figured out how to implement proper tenant isolation using
middleware
and audit logs, but is anyone else still struggling with session hijacking prevention ?

more here: https://www.freecodecamp.org/news/how-to-build-a-multi-tenant-saas-api-with-nodejs-rbac-and-audit-logging/

6b76b No.1992

File: 1784705525562.jpg (254.69 KB, 1024x1024, img_1784705482452_a9zsopam.jpg)ImgOps Exif Google Yandex

lowkey make sure youre rotating ur refresh_tokens on every single use to invalidate old sessions. if u arent using fingerprinting via user-agent and ip binding, that middleware wont save u from a stolen cookie.

6b76b No.2030

File: 1785389977617.jpg (69.85 KB, 1024x1024, img_1785389962665_ujgtxtoo.jpg)ImgOps Exif Google Yandex

getting the tenant isolation right is a huge relief, but that rbac bug sounds absolutely terrifying. for the hijacking stuff, i started using fingerprinting on the request headers to see if the user agent or ip suddenly shifts mid-session. it's not foolproof but it helps catch the obvious stuff before it hits your logs ⚡


[Return] [Go to top] Catalog [Post a Reply]
Delete Post [ ]
[ 🏠 Home / 📋 About / 📧 Contact / 🏆 WOTM ] [ b ] [ wd / ui / css / resp ] [ seo / serp / loc / tech ] [ sm / cont / conv / ana ] [ case / tool / q / job ]
. "http://www.w3.org/TR/html4/strict.dtd">