Tag
Every post tagged API Security.
Backend & APIs
A walkthrough of the security layer in my NestJS 11 + Prisma 7 starter: Helmet headers, a CORS allow-list, three-window rate limiting, opt-in CSRF, header-free Pino logs and a Prisma error filter, with the real code and the gaps still to close.
AI Engineering
How Benchline runs 61 browser tools where each one is a pure function shared by a web page, a stateless Streamable HTTP MCP server and a JSON API, using real code from the repo.
Next.js & React
A tested Better Auth 1.7 setup for Next.js 16.4 with Prisma 7 and PostgreSQL: route handler, server-action sign-in with nextCookies, proxy.ts checks, query counts per page load, the joins gotcha and Better Auth vs Clerk.
AI Engineering
MCP is stateless since the 2026-07-28 spec: no initialize, no Mcp-Session-Id. What changed on the wire, a tested TypeScript SDK v2 server on two instances, handles, requestState, MRTR elicitation and a migration checklist.
Next.js & React
The October 14, 2026 Next.js security update fixes two critical RCEs (use cache and SVG via sharp) and a Server Actions DoS. Check if you are affected, run a free checker script, and patch Next.js 15 and 16 on Docker or Coolify.
Next.js & React
Server Actions vs Route Handlers in Next.js 16: use Server Actions for mutations from your own UI, Route Handlers for webhooks, mobile apps and public APIs, and Server Components for reads. Tested code, comparison tables and security rules.
AI Engineering
A step-by-step guide to build an MCP server in Next.js with the official v2 TypeScript SDK: an App Router route handler, Streamable HTTP, bearer-token auth, Origin checks and Zod-validated tools.
