Module 04 Summary

What this module established

Paths identify, queries filter and page, headers carry credentials. Anything optional does not belong in a path, and every query parameter needs a default and a bound - an unbounded limit is a denial-of-service vector in your own code.

Carry forward

• Put constraints on the model so they run before your handler, cannot be forgotten, and appear in the published contract.
• Declare every input in the signature. Anything read from the raw request is invisible to the contract, the validation and the docs.
• Credentials go in headers, never the query string. Identity comes from the verified credential, never a parameter the caller supplies.

Before moving on

Move on when every query parameter is bounded and no credential or identity claim travels in a query string.

Mark complete