Why Display Names Should Never Be Used for Authorization in Web Apps

·1 views

A common security flaw in apps with anonymous participation is treating a user's display name as an authorization credential, which it is not. Display names are publicly visible, easy to guess, and only serve to identify a record — not to prove who has the right to modify it. Anyone who knows or guesses a participant's name could exploit such systems to overwrite another person's data. For anonymous users, a secure alternative is issuing a cryptographically random token stored in an HttpOnly cookie, with only its SHA-256 hash saved server-side. Authenticated users should be authorized via immutable session-based user IDs, never through values supplied in request bodies or query parameters.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Microsoft Foundry Uses OpenTelemetry to Bring Deep Observability to AI Agent Runs

Microsoft Foundry offers a structured observability pipeline for AI agents, built on OpenTelemetry semantic conventions and backed by Azure Monitor Application Insights. Unlike flat logs, agent tracing captures the full execution tree of a single agent run — including model calls, tool invocations, retrievals, and handoffs to other agents. Each step in the tree is recorded as a span with its own latency, token cost, and failure data, enabling engineers to pinpoint exactly where errors originate across complex multi-step workflows. The platform also supports a continuous evaluation loop that automatically grades production traffic by sampling structured trace data, removing the need for manual review. Microsoft positions this tracing capability as a core architectural feature rather than an add-on, sitting alongside evaluation and monitoring as a first-class pillar of the Foundry platform.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MyZubster Dev Team Fixes Privacy Bug and Brittle Tests While Stabilizing Node.js Platform

The team behind MyZubster, a Node.js platform with subsystems spanning payments, social login, and a marketplace, has been working to stabilize its test suite by classifying failures as real bugs, stale tests, or architectural mismatches. A seemingly outdated Cultural API test revealed a genuine privacy issue where the public event endpoint was still exposing owner identity data, prompting a targeted production fix. Separately, several UI test failures were traced to fragile string comparisons that checked exact whitespace and variable names rather than actual behavior, and these were replaced with semantic regular expressions. The approach allowed the team to fix a real privacy boundary violation and eliminate false failures without making arbitrary changes to production code. The effort reflects a broader principle that a failing test should be treated as evidence of a potential issue before it is simply rewritten or deleted.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Five techniques to shrink bloated Docker images from gigabytes to megabytes

Poorly optimised Docker images for simple Node.js apps can balloon past 1GB, primarily due to heavy base images, included dev dependencies, and unfiltered source files copied into the container. Switching from the full node:20 Debian base image to the Alpine variant alone can cut image size from roughly 1.1GB down to about 150MB. Using multi-stage builds further reduces this by keeping build tools and dev dependencies out of the final production image, pushing sizes closer to 100MB. A .dockerignore file prevents directories like .git, tests, and coverage reports from being copied in, which can save an additional 10–30% in size. For compiled languages like Go, using a distroless base image that contains only the application binary can reduce final image size to as little as 15MB, a roughly 90% reduction.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds RAG system to fix AI hallucinations in company knowledge tools

A developer replaced model-memory-based AI responses with a retrieval-augmented generation (RAG) system after finding that large language models confidently fabricate answers when queried about company-specific content. The solution was built using Python, FastAPI, LangChain, OpenAI, Anthropic, Pinecone, Postgres, and Docker. Answers are now grounded in actual source documents and delivered automatically via Slack on a scheduled basis. The system required no migration effort from the non-technical team responsible for maintaining it. The developer concluded that AI inaccuracy in enterprise contexts is fundamentally a retrieval problem, not a model capability problem.

0 comments Read more at DEV Community