#security

Web Platformintermediate

Use URL.canParse for safer URL handling

export const parseValidUrls = (candidates: string[], base?: string): URL[] =>
  candidates.filter((candidate) => URL.canParse(candidate, base)).map((candidate) => new URL(candidate, base));

export const isSameOriginRedirect = (target: string, currentOrigin: string): boolean => {
  if (!URL.canParse(target, currentOrigin)) return false;

Validate URLs before you build or parse them with the built-in URL API.

Bunintermediate

Password hashing with Bun.password, no bcrypt dependency

export const hashPassword = (password: string) =>
  Bun.password.hash(password, { algorithm: "argon2id", memoryCost: 19456, timeCost: 2 });

export const verifyPassword = (password: string, hash: string) => Bun.password.verify(password, hash);

Bun.password.hash and .verify wrap argon2 and bcrypt natively, so hashing a password needs no bcrypt or argon2 npm package at all.