Security Notes
Security considerations for wpzylos-http.
Request Security
Never Trust Request Data
All request input is untrusted:
// Bad: Direct database query
$id = $request->input('id');
$wpdb->query("DELETE FROM posts WHERE id = {$id}");
// Good: Validate and sanitize
$id = absint($request->input('id'));
$wpdb->query($wpdb->prepare("DELETE FROM posts WHERE id = %d", $id));
Validate File Uploads
$file = $request->file('upload');
// Check MIME type
$allowed = ['image/jpeg', 'image/png'];
if (!in_array($file->getMimeType(), $allowed, true)) {
wp_die('Invalid file type');
}
Response Security
Set Security Headers
Response::json($data)
->header('X-Content-Type-Options', 'nosniff')
->header('X-Frame-Options', 'DENY')
->send();
Avoid Sensitive Data in Responses
// Bad: Exposes internal details
return Response::json([
'user' => $user->toArray(), // May include password hash
]);
// Good: Explicit safe fields
return Response::json([
'user' => [
'id' => $user->id,
'name' => $user->name,
],
]);