Tag
Every post tagged NestJS.
Backend & APIs
A regex on the hostname is not SSRF protection. I ran 16 bypass payloads against three checks on Node.js 20 and show the approach that holds up: new URL(), net.BlockList, re-checking every redirect hop and validating the DNS answer at connect time.
Backend & APIs
How to stream live job progress from NestJS with @Sse and RxJS, with the patterns from my Snagbox API: ReplaySubject per job, your own event ids, comment heartbeats, and why one stream per item stalls Chrome. Every behaviour tested on NestJS 12.1.3.
Backend & APIs
A walkthrough of the security layer in my NestJS 11 + Prisma 7 starter: Helmet headers, a CORS allow-list, three-window rate limiting, opt-in CSRF, header-free Pino logs and a Prisma error filter, with the real code and the gaps still to close.
Backend & APIs
I upgraded a real NestJS 11 API to NestJS 12.1.3 with nest upgrade, fixed what broke (TypeScript 6, Jest and ESM, @Optional), and benchmarked v11 vs v12, Zod vs class-validator, Jest vs Vitest, ESLint vs oxlint, TypeScript 7 and Bun.
