Module 04 Activity

Scenario

Get every input into the signature, in the right place, with bounds.

What you build

Endpoints where every parameter is declared, defaulted and constrained, with credentials in headers.

Steps

1. Put resource identity in the path and everything optional in the query. Fix anything optional currently in a path.
2. Give every query parameter a default and a maximum. Find any unbounded limit and bound it.
3. Move all body validation onto the model so it runs before the handler.
4. Build one endpoint drawing from path, query, body and header together.
5. Audit for credentials or identity claims in query strings and move them to headers.
6. Confirm nothing is read from the raw request object.

Evidence to hand in

• The path/query split with any fixes.
• Bounds on every query parameter.
• Body validation on the model.
• The four-source endpoint.
• The credential audit.

Review checklist

• Nothing optional remains in a path.
• Every query parameter has a default and a maximum.
• All body validation is on the model, not in the handler.
• No credential or identity claim travels in a query string.
• Nothing is read from the raw request object.

Mark complete