#apisecurity

Articles tagged with #apisecurity

Rate Limiting Alone Won't Stop a Patient Attacker
@nestjs/throttler counts requests per IP. It has no idea what an account is. Here's what that gap actually looks like, and the Redis-backed lockout that closes it.
Sep 25, 20268 min read
Four Ways a Refresh Token Request Fails — Only One Means Trouble
Invalid, expired, revoked, and reused tokens aren't the same. Build real refresh token reuse detection in NestJS + Postgres—and verify it revokes only the compromised session.
Sep 25, 20269 min read