Security
3 posts
Restorable but not shareable: hiding a token in history.state
A result that survives refresh and the back button but cannot be shared by copying the URL. A forgotten browser API, a header, and one deliberate deletion.
Our rate limits were bypassed by a trailing slash
Five tuned Rack::Attack throttles, all matching the path exactly. Rails normalised the path after they ran, so a dot-json or a trailing slash bypassed every one.
Treat model output like user input
When strangers write the prompt and the answer renders on your page, you have two untrusted boundaries back to back. The layered posture we settled on.
