7 posts
Deny-by-default is one layer. Here's every other threat the bridge is built to handle — prototype pollution, CSRF, and the line between what it secures and what your code still has to.
Import your normal API client into a client component and check the Network tab. This is the architecture that stops that from happening.
Bearer, cookie, API key, OAuth2 — and the one bug almost every hand-rolled auth layer has: four parallel requests triggering four token refreshes at once.
A practical walk through the vercel.json headers block I ship in production — HSTS, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, and immutable long-cache for hashed assets, fonts, and images.
A honeypot is a hidden form field humans never see and bots always fill. Here's how I added one to my contact form — the hidden input on the client and the silent 200 on the server.
A tiny sliding-window rate limiter that tracks requests per IP in memory and returns 429 when a client sends too many — plus an honest look at why in-memory limits are only a first line of defence on serverless.
Access tokens leak. Refresh tokens live for weeks. Rotation with reuse detection is what stops a stolen token from becoming a permanent backdoor — here's how I built it in MERN Notes, and how RBAC layers cleanly on top.