Tag: Security

Power Pages Server Logic validates browser data, request size, authorization and OData filters before React reaches the Dataverse Custom API.

I wanted to inspect Qdrant data in the browser without making the database public. Locally I use Traefik; in production I open only an SSH tunnel and keep Qdrant internal.

Before launch, I reviewed my architecture for more than scaling. I also examined implicit security assumptions and found two small gaps that could quickly become costly in production.

Without rate limiting, one script can exhaust the AI provider key within minutes. Two independent layers address this: Traefik limits by IP, while express-rate-limit with Redis backing limits by authenticated user. Why both layers matter and how to handle the Redis adapter’s TypeScript mismatch.

OAuth 2.0 and OIDC return two tokens at login, and almost every implementation reads the email address from the wrong one. Why access_token and id_token serve fundamentally different purposes, and why the Userinfo endpoint is the more reliable source for user profile data.

One compromised script in the header is enough to steal your portal users’ identities. Learn how a supply chain attack targets Microsoft Power Pages and how a strict architecture protects your portal.