---
name: server-security
description: "Harden concrete API trust boundaries without expanding product scope. Use for security, rate limits, validation."
---

# Валидация и лимиты

Harden concrete API trust boundaries without expanding product scope.

## Implementation decisions

1. Limit request bytes while reading, not only with Content-Length.
2. Validate lengths, quantities and IDs and never trust client totals.
3. Parameterize SQL values and allowlist dynamic identifiers.
4. Use platform-backed rate limiting and authentication before publicly exposing mutating demo backends. In-memory counters are not durable protection.

## Working source

Read [app/api/quote/route.ts](../webcraft-shared/source/app/api/quote/route.ts) when implementing this capability. The example belongs to the WEBCRAFT React/Three.js playground except the Python commerce starter, which runs without third-party dependencies. Use [shared catalog](../webcraft-shared/source/lib/catalog.ts) only to resolve related examples. Adapt the source to the target framework and preserve existing project conventions.

## Verify observable behavior

- Chunked data cannot bypass body limits.
- Invalid input never reaches raw SQL.
- Logs omit tokens and complete personal payloads.

## Scope

Use only the parts relevant to the requested task. This skill does not grant permission to publish, spend money, change account access or expose secrets. The original brief and environment rules remain authoritative.

Version 2.0.0 · Original WEBCRAFT content · MIT