Fullstack CourseLearn by building
Back to examples

Security & performance

Pick how the session is stored, then run a fake XSS probe.

Week 3 · security

Try it

Choose a storage mode, then run the probe. The cookie path is what this course uses with Nest.

Probe result appears here.

// ✅ Nest
res.cookie('access_token', jwt, { httpOnly: true, sameSite: 'lax' })

// ✅ Axios
withCredentials: true

Right for this course: Nest sets the cookie; Axios sends it with credentials.

Also

  • Nest DTOs validate again — never trust the client alone
  • No private secrets in NEXT_PUBLIC_*
  • Paginate Nest lists; use Query staleTime to avoid refetch storms

Real cookie session: /login