Files
What you'll learn
- Return entities safely: @Exclude() on a secret column and the ClassSerializerInterceptor for the whole app
- Limit every route with the ThrottlerGuard, and tighten one route with @Throttle()
- Add helmet's security headers and read what each one does
- Allow one front end's origin with CORS, and check both a preflight it passes and one from an origin it refuses
Press Run tests to start the app. Its log appears here.Graded endpoints
helmet adds its security headers to every response
The browser asks before a cross-origin POST with a token; the service says which origin, methods and headers it allows
No Access-Control-Allow-Origin: the browser will refuse to send the request
Unchanged
The service now answers the stored entity; the serializer leaves the hash out
The database filter's 409
First sign-in this minute
Second
The stored user, serialized: no hash
Third attempt this minute, still a 401
Sign-in allows three a minute; the right password does not help
Roles still apply
Updates are staff-only
And removals
The cats module's other routes are not limited beyond the app-wide ceiling
Validation is unchanged
Staff updates still work
The breed filter
The adoption, serialized like everything else
The transaction's 409
Her second
The limit and its rollback
Tom and Milo; Luna is not among them
Staff only
The same two
Rolled back earlier, so Luna has no adoption to keep her
404
Still 401