September 2023 Summaries

In this article, we explored how to build a secure web application using Strapi policies. We created various policies such as consent policy, rate-limit policy, ip whitelist policy, location-input policy, account-locked policy and is-admin policy. These policies help in ensuring the security of our applications by validating user inputs, controlling access to certain routes, limiting API requests, filtering out malicious IP addresses, blocking accounts for a specified period, and checking if a user has admin privileges. By using Strapi policies, we can ensure that our web application is secure and follows best practices for API security.

The article provides an in-depth tutorial on creating and implementing policies within a Strapi application, which is a headless content management system for building backend applications. It explains the concept of policies, likening them to security checkpoints that ensure requests to the server adhere to predefined rules. The tutorial covers the creation of global and API-specific policies using Strapi's command-line tools, illustrating the process with example codes and configurations. It also introduces the use of Joi for schema validation to ensure that data sent through API requests meet certain criteria. Additionally, the article discusses how to configure error handling within policies to provide more informative feedback when requests fail. Throughout the tutorial, practical examples and step-by-step instructions are provided to guide users in building and testing their own policies, with additional resources for further learning.

Strapi has addressed four security vulnerabilities in its platform, thanks to the contributions from community members and a diligent internal process that involved testing, validation, and communication. The vulnerabilities affected various components, including the content-manager plugin, rate-limiting middleware, RBAC permissions, and the handling of custom fields during user registration. In response, Strapi has released patches, urging users to upgrade to version v4.13.5 or greater to ensure all issues are resolved and has shared detailed disclosures following a mandatory waiting period to allow users time to upgrade. The company emphasizes responsible disclosure to protect users from potential exploitation and has communicated the necessary updates to its enterprise and cloud customers. Strapi appreciates the professional conduct of security researchers in identifying and helping to fix these vulnerabilities and encourages others to report any potential security issues through their established channels.

Strapi has launched several new features aimed at enhancing user experience for both its CMS and Strapi Cloud products. The release of Strapi v4.13 introduces improvements such as enhanced review workflows, list view filters, and additional TypeScript support, facilitating better collaboration, compliance, and performance for developers and marketers. New features for Strapi Cloud include the ability to host projects in European data centers, ensuring GDPR compliance, and a Shared Projects feature that simplifies collaboration by allowing multiple developers to manage projects from a single account. These updates aim to streamline content management, improve backend customization, and offer greater flexibility in data hosting, making Strapi an increasingly robust tool for creators and agencies.

In this article, the author discusses the use of transactions in Strapi v4 to manage data imports and maintain data integrity within their projects at UFirst Group. They emphasize the importance of transactions to avoid corrupting the database during bulk data imports, such as those from CSV files, by using a mechanism that allows changes to be committed or rolled back to a previous state if errors occur. The article provides practical examples of using transactions with Strapi, leveraging Knex.js for SQL query building, and demonstrates both committing and rolling back transactions through test cases. These transactions ensure that data remains uncorrupted and users are not affected by incomplete or erroneous data changes. The author also hints at future discussions about incorporating Typescript support to enhance control over data operations.