It’s a standard Tuesday afternoon refactor. You’re spinning up a new internal microservice that processes raw invoice data sent from your primary public-facing gateway. It’s a backend-to-backend connection, safely tucked away inside your company’s Virtual Private Cloud (VPC), far behind a wall of corporate firewalls, IP whitelists, and cloud security groups.
You look at the code you just wrote to fetch records from the database:
C#
// We don’t need parameterized queries here; the input comes from our upstream Inventory API
var query = $”SELECT * FROM Invoices WHERE BatchId = ‘{inputBatchId}'”;
A little voice in your head whispers: “Hey, shouldn’t we validate that inputBatchId? Shouldn’t we enforce token scopes here, or at least encrypt this internal traffic over HTTPS?”
You dismiss it with a wave of your hand. “Nah, it’s fine. It’s only an internal API. Nobody from the outside can hit this endpoint anyway. Why waste time on … Read the rest