TIL: Sep 30

TIL: You can prevent IDOR vulnerabilities in Next.js server actions by explicitly validating session user ownership alongside RBAC checks, rather than relying solely on server-side role headers. Furthermore, implementing btree_gist with overlap exclusion constraints in Drizzle/Postgres provides a robust database-level mechanism to prevent conflicting data entries—such as concurrent bookings—that application logic might otherwise miss.