I always take care to not trust raw user input, and add rate limiting and request size limits. I'm sure there is more I can be doing, but this is not my area of expertise.
- Assume that the caller might not be a browser, so don't assume anything regardling workflows between calls.
- Keep up to date with OWASP, https://owasp.org/
I always take care to not trust raw user input, and add rate limiting and request size limits. I'm sure there is more I can be doing, but this is not my area of expertise.