TypeScript Types Don't Validate API Request Bodies at Runtime

·4 views

A developer explains that TypeScript types are erased at runtime, so they cannot guarantee the shape of incoming API request bodies. Using a type assertion simply tells the compiler to trust the data, which can let malformed or malicious input through. The article describes concrete risks, including server crashes from unexpected values, corrupted stored data, and mass assignment that lets clients set privileged fields like role. The recommended fix is runtime schema validation with a library such as Zod, which rejects bad input with a 400 response and strips unknown fields. Treating every value crossing a program's boundary as untrusted is presented as the core principle.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Guide Explains How C2PA and Other Metadata Can Be Removed From Images

A guide published on DEV Community explains the different types of information stored in image files, including C2PA Content Credentials, EXIF, XMP, and invisible pixel watermarks. It notes that C2PA is an open, signed provenance standard, while EXIF and XMP are older metadata formats that record camera, location, and editing details. The article points out that removing metadata does not eliminate pixel-level watermarks such as Google SynthID, and that platforms may use other signals to label AI content. It also outlines legitimate reasons for stripping metadata, such as privacy and file hygiene, and compares lossless removal with re-export methods that can reduce image quality.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Palo Alto Networks Reportedly Eyes $500M Clutch Security Deal Over AI Agent Credentials

Palo Alto Networks is reportedly prepared to pay about $500 million for Clutch Security, a three-year-old startup with roughly $10 million in annual revenue. The deal would target the non-human identities, such as API keys, service accounts, and tokens, that AI agents use inside enterprise systems. The article notes that such identities greatly outnumber human accounts, and that few are under identity-governance oversight. It also cites research showing most enterprise permissions go unused and that only a minority of organizations feel able to control their AI agents. Similar acquisitions by Cyera, Cisco, and CrowdStrike are cited as evidence of a broader industry race for this security category.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-source guide shows how to learn programming on an Android phone alone

A developer has released Awesome Mobile Dev, an open-source project aimed at helping people learn programming without a laptop or desktop computer. The curated list covers tools such as Termux, a terminal environment for Android, along with code editors and resources for languages including Python, JavaScript, Rust and Go. It also includes material on Git and GitHub, Android app development, and Linux and SSH tools. The creator says a smartphone should not be a barrier to learning to code or contributing to open-source projects. The project is hosted on GitHub and invites community contributions of additional tools and resources.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Laravel Mail Not Sending? Eight Fixes That Work

Emails that never arrive from a Laravel app are a very common problem, often despite code that appears correct and no obvious error. The guide says the cause is usually something small and recommends checking the likeliest culprits first, such as the .env settings, stale config cache, and mismatched port and encryption. It also covers queues that never process because no worker is running, and Gmail rejecting normal passwords in favor of App Passwords. Readers are pointed to storage/logs/laravel.log for error details and to a quick tinker test to confirm whether SMTP is working.

0 comments Read more at DEV Community