Page 2 - Security/OWASP

Nuxt middleware is the central mechanism for protecting routes, enforcing authentication and cleanly implementing role-based access control at the app layer, without copying security logic into every single page.

Tagged Template Literals are far more than pretty string interpolation. With a tag function in front of them, they turn into a powerful tool: SQL injection protection, safe HTML escaping, and domain-specific languages, all directly in JavaScript, without external parsers.

Containers on a developer laptop and containers in production are two fundamentally different things. This Docker checklist covers every mandatory category: security hardening, performance limits, storage protection, and repeatable deployment procedures, with concrete commands for each item.

GDPR requires that a notifiable personal data breach be reported to the competent supervisory authority within 72 hours of becoming aware of it. That deadline sounds clear in theory, but quickly turns into a real problem when a company has to scramble an IT team together on a weekend just to figure out which data was affected and to what extent. Defining the notification process ahead of time, and building the technical foundation for a fast scope assessment, turns a crisis into a workable checklist.

Persisted Queries solve two problems at once: they reduce the amount of data transferred and close a security gap that is often overlooked in public GraphQL APIs. Anyone who accepts arbitrary queries hands attackers a free pass. Anyone who only allows known queries gains control, without sacrificing flexibility entirely.

A Docker image that gets built once and never checked for vulnerabilities again slowly turns into a security hole. Image scanning in the CI pipeline and automatic base image updates close that window before CVEs make it into production.

A Content Security Policy is the single most effective HTTP header against cross site scripting, yet most projects either skip it entirely or ship it with a far too generous whitelist. This article shows how a Content Security Policy grows from the first directive through nonces and hashes all the way to a hard enforcement mode, without suddenly breaking inline scripts or third party tools.

Integrating custom fields into the customer types, securing resolvers with token validation, exposing extension attributes correctly, and protecting sensitive data at the field level, all in one hands-on practical article.

Giving every application and developer the same database account with full rights automatically turns any future security gap into total damage. Granular database user privileges, built from GRANT statements, role hierarchies and the principle of least privilege, limit the damage of a single compromised account to exactly what that account genuinely needs.

Security auditors open an OpenAPI document with a clear checklist in mind: are all endpoints authenticated? Are error responses fully documented? Is input validated? Whoever understands this perspective builds API documentation that speeds up audits, reduces findings, and builds trust.