99% of the time, not great, everyone codes their connection points as if their beloved JavaScript function is the only caller.
I always take care to not trust raw user input, and add rate limiting and request size limits. I'm sure there is more I can be doing, but this is not my area of expertise.
- Assume that the caller might not be a browser, so don't assume anything regardling workflows between calls.
- Keep up to date with OWASP, https://owasp.org/
99% of the time, not great, everyone codes their connection points as if their beloved JavaScript function is the only caller.