ABBA’s Own!😊. Cybersecurity Analyst & Software Engineer 🇨🇦. @StrategiaLLC. Chem Engineer👨🔬Social service @MBGov. Forex Dude📈 #FCB⚽️.
Winnipeg, Manitoba
Joined July 2018
- Tweets15K
- Following1.1K
- Followers4K
- Likes57K
Pinned Tweet
Been home and off work for a while and I decided to build a new portfolio for myself
Check it out here adeniyi-richard.netlify.app
Day 15 of building InvoiceFlow in public 🔐 Week 3 starts on invoices: invoice and line item tables, with money stored as decimal(18,2), never float. Security note: a commenter on my Day 14 post pointed out that most tenant leaks come from one new endpoint that skips the auth check. So before writing any invoice code, I made the API secure by default. Every endpoint now requires sign-in unless it's explicitly marked public, and a test walks every route and fails the build if one answers while signed out. Invoices carry an owner and the same global query filter from day one. 🔒 github.com/TheNiyiRichard/in… #BuildInPublic #ASPNETCore #DotNet #Cybersecurity
Day 14 of building InvoiceFlow in public 🔐 Week 2 is done: accounts, secure cookies, lockout and every client scoped to its owner. Today I wrote automated tests that boot the real API against a throwaway database, sign in two users, and prove user B can't list, read, edit or delete user A's clients. Security note: a security test only counts if you've seen it fail, so I deliberately removed the ownership check, watched the test go red as B read A's data, then put it back. That's the bug I almost shipped. 🔒 github.com/TheNiyiRichard/in… #BuildInPublic #xUnit #DotNet #Cybersecurity
YourTechBro🇳🇬🇨🇦 retweeted
Day 14 of building InvoiceFlow in public 🔐 Week 2 is done: accounts, secure cookies, lockout and every client scoped to its owner. Today I wrote automated tests that boot the real API against a throwaway database, sign in two users, and prove user B can't list, read, edit or delete user A's clients. Security note: a security test only counts if you've seen it fail, so I deliberately removed the ownership check, watched the test go red as B read A's data, then put it back. That's the bug I almost shipped. 🔒 github.com/TheNiyiRichard/in… #BuildInPublic #xUnit #DotNet #Cybersecurity
Day 13 of building InvoiceFlow in public 🔐 Every client now belongs to the user who created it, and the React app has an auth context with protected routes. Security note: this fixes IDOR, the classic invoice-app leak someone asked about on my Day 6 post. Every query filters on the signed-in user, an EF Core global query filter catches any query that forgets, and asking for someone else's client returns 404, not 403, so you can't even confirm it exists. Tomorrow I write a test that proves it. 🔒 github.com/TheNiyiRichard/in… #BuildInPublic #ASPNETCore #DotNet #Cybersecurity
Great point, that's the realistic failure mode. Right now protection is opt-in per controller, so this week I'm switching to a fallback policy that requires auth on every endpoint unless it's explicitly marked anonymous, plus a test that enumerates all routes and fails if any non-allowlisted one answers signed-out. When invoices land, the B-vs-A ownership checks get extended across every id route too.
Day 14 of building InvoiceFlow in public 🔐 Week 2 is done: accounts, secure cookies, lockout and every client scoped to its owner. Today I wrote automated tests that boot the real API against a throwaway database, sign in two users, and prove user B can't list, read, edit or delete user A's clients. Security note: a security test only counts if you've seen it fail, so I deliberately removed the ownership check, watched the test go red as B read A's data, then put it back. That's the bug I almost shipped. 🔒 github.com/TheNiyiRichard/in… #BuildInPublic #xUnit #DotNet #Cybersecurity
Day 13 of building InvoiceFlow in public 🔐 Every client now belongs to the user who created it, and the React app has an auth context with protected routes. Security note: this fixes IDOR, the classic invoice-app leak someone asked about on my Day 6 post. Every query filters on the signed-in user, an EF Core global query filter catches any query that forgets, and asking for someone else's client returns 404, not 403, so you can't even confirm it exists. Tomorrow I write a test that proves it. 🔒 github.com/TheNiyiRichard/in… #BuildInPublic #ASPNETCore #DotNet #Cybersecurity
Product designers I envy you guys 😂!
This is lovely!!!
Oh well, finally completed my portfolio redesign
wendyenyi.vercel.app
YourTechBro🇳🇬🇨🇦 retweeted
Oh well, finally completed my portfolio redesign
wendyenyi.vercel.app
Ain’t no way anyone is getting to know even 50% of who I am from my social media presence. At best you get access to the most superficial details like what I do, what I’m interested in, maybe a glimpse of my lifestyle.
But there’s a huge difference between knowing information about someone and actually knowing the person. People only get to know what you choose to make accessible, and I’ve never been one to put my entire personality on display for public consumption. My social media is a presence, not an autobiography and would forever be.
one thing i hate about having a social media presence is the fact that anyone i’m talking to already knows like 60-70% about me.
i don’t even guess anymore, i just assume they already stalked me.
it’s funny cos i don’t do this, takes away the whole phase of actually getting to know them. but that’s just me.
Day 13 of building InvoiceFlow in public 🔐 Every client now belongs to the user who created it, and the React app has an auth context with protected routes. Security note: this fixes IDOR, the classic invoice-app leak someone asked about on my Day 6 post. Every query filters on the signed-in user, an EF Core global query filter catches any query that forgets, and asking for someone else's client returns 404, not 403, so you can't even confirm it exists. Tomorrow I write a test that proves it. 🔒 github.com/TheNiyiRichard/in… #BuildInPublic #ASPNETCore #DotNet #Cybersecurity
Day 12 of building InvoiceFlow in public 🔐 The sign-in and register screens are live in React and connected to the API. Sign-up asks for your name, an optional business name, your email and a password, and nothing else until it's needed. Security note: the password can't contain your name or email, the forms work with password managers and a show-password toggle, and JavaScript never touches the session cookie. Email verification and password reset plans are now in motion. 🔒 github.com/TheNiyiRichard/in… #BuildInPublic #React #DotNet #Cybersecurity