Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Why is it important to explicitly allowlist which fields a client can filter on, rather than converting every incoming query parameter directly into a database filter?
💻 Code Challenge | +75 XP
Implement a GET /orders endpoint with Zod-validated filters for status (enum) and a total range (minTotal/maxTotal as numbers), using an explicit allowlist rather than blindly passing through all query parameters.
A security review found that an orders list endpoint accepted an unintended "internalFlag" query parameter that filtered on an internal field never meant to be publicly exposed. Reorder the steps to fix this correctly.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Converting every incoming query parameter directly into a database filter without an explicit allowlist
// Wrong: any query param becomes a filter, unintended fields included
const where = { ...req.query };
// Correct: explicit allowlist of genuinely supported filters
const ALLOWED_FILTERS = ["status", "customerId"];
const where = {};
for (const key of ALLOWED_FILTERS) if (req.query[key]) where[key] = req.query[key];The Solution //
This exposes filtering on any field a client happens to guess the name of, including internal, sensitive, or unindexed fields never intended to be publicly filterable — both a security concern and a performance risk if an unindexed field is filtered on at scale.
The Error //
Validating that a filter field is allowlisted, but not validating the actual filter value's type or range
// Wrong: field allowlisted, but value never validated
if (req.query.minTotal) where.total = { gte: req.query.minTotal }; // still a raw string!
// Correct: value type/range validated explicitly
const minTotal = z.coerce.number().nonnegative().parse(req.query.minTotal);The Solution //
A numeric filter like minTotal receiving a non-numeric string, or a status filter receiving a value outside the actual valid status enum, can silently produce an incorrect query or a confusing database error instead of a clear, immediate validation error to the client.