Which approach best protects a Node.js API against NoSQL injection?
- A Escaping quotes in input
- B Validating request input against a schema and rejecting object-valued parameters
- C Limiting request size
- D Disabling error messages
Answer
Validating request input against a schema and rejecting object-valued parameters
Passing an object such as { $gt: '' } where a string is expected can bypass authentication. Schema validation at the edge prevents it.





