What is Endpoint?
One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
Where Endpoint goes wrong in real apps
Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.
Bills that explode · 4 minutes · Free
The open summarise button
Your app has a free 'summarise this PDF' button. Your AI bill says you made 2 million requests last night. You have 60 users.
Walk it, freeHow do I stop people abusing my app's AI endpoint?
Require sign-in, limit requests per user and per IP address, and cap the size of each request's input and output. Hiding the API key on your server is necessary but not enough: the endpoint that uses the key is public, and a script can call it millions of times.
Who may see what · 4 minutes · Pro
The admin button
Only admins see the Refund button. A regular user has just refunded their own last three orders.
Read the fixIs hiding the admin button enough?
No. Hiding a button only changes what is shown. Anyone can send the same request without the button. Every sensitive endpoint must check the caller's role on the server, reading that role from your database or a verified session, never from the request body.
Getting paid · 4 minutes · Pro
The webhook that failed every time
Payments work. Upgrades don't. Stripe's dashboard shows every webhook to your app failing with a 400.
Read the fixWhy does Stripe webhook verification fail?
The signature covers the exact raw bytes Stripe sent. It fails when your code parses the body as JSON before verifying, or when it uses the wrong signing secret. In Next.js App Router, read the body with request.text() and pass it unchanged to constructEvent. Each endpoint, including the Stripe CLI, has its own whsec_ secret.
Who may see what · 4 minutes · Free
Invoice 105
Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.
Walk it, freeWhat is an IDOR vulnerability?
An IDOR (insecure direct object reference) is when an app loads a record by an id from the URL or request without checking that the signed-in user owns it. Changing /invoices/104 to /invoices/105 then shows someone else's invoice. The fix is to scope every query to the current user on the server.
Who may see what · 4 minutes · Pro
Open it in incognito
Everything works when you are signed in. A security researcher emails: 'Try your API from a private window.'
Read the fixHow do I test my app for exposed data?
Test every page and API route as four people: signed out, a normal user, a different user, and an admin. Any endpoint that returns data or makes changes for someone who should be refused is a security bug. Testing only while signed in as yourself hides these bugs.
Who may see what · 4 minutes · Pro
The redirect that let them in
Your middleware sends signed-out visitors to the login page. A security advisory says one extra header can skip middleware entirely.
Read the fixIs middleware enough to protect my pages?
No. Middleware is a useful place for redirects, but it is a single layer, and framework bugs have allowed requests to skip it. Check authorization again wherever data is read: in server pages, route handlers and database rules. Keep your framework patched.
Related terms
- Request
- A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
- Server
- A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
- API
- The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
- Authentication
- Checking who someone is, usually by signing in.
- Browser
- Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
- Secret key
- A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.