Are template literals safe for dynamic routes in Node.js?

0
1
Asked By CuriousCoder99 On

Hey everyone, I'm curious about the safety of using template literals for dynamic routes in Node.js, especially with Express. For instance, I've got this route set up:

app.get("/posts/:postID", (req, res) => {
// retrieve post info from database
});

Then on the front end, I have this function:

async function getPostInfo() {
const response = await fetch(`/posts/${postID}`);
const post = await response.json();
return post;
}

If I ensure that I use parameterization for my Postgres queries, is this a secure way to handle requests? It seems like it should work, but I'm still pretty new to Node.js and I want to make sure I understand any potential vulnerabilities, like XSS. Appreciate any insights you can share!

1 Answer

Answered By Keven Krok On

The safety really hinges on how you handle your postID. The frontend doesn’t matter much since anyone can make requests directly to your server. Just make sure the postID is validated. If you're parameterizing your Postgres queries properly, you're on the right track! Just remember, anyone can request any post ID unless you have additional checks in place.

Related Questions

LEAVE A REPLY

Please enter your comment!
Please enter your name here

This site uses Akismet to reduce spam. Learn how your comment data is processed.