后端服务 grpc-services-security 更新于 2026-08-15

gRPC · 安全规则

Security rules for gRPC: boundary validation, server-side authorisation and zero secret leakage.

✓ 应当这么做

✓ Validate and normalise every input at the boundary it enters the system
✓ Authorise on the server against the authenticated principal, never on client claims
✓ Keep secrets out of repositories, logs and error messages

36 篇

Node.js async rules: validated boundaries, non-blocking I/O and graceful shutdown

NestJS rules: thin controllers, validated DTOs and evented module boundaries

Spring Boot rules: constructor injection, transaction boundaries and validated input

FastAPI rules: Pydantic boundary models and dependency-injected services

Django rules: queryset-level filtering and explicit select_related usage

Flask rules: blueprint-scoped config and application-factory wiring