Quick questions on Server-side programming explained: HSC Software Engineering Module 2

A server-side framework maps HTTP method + path to a handler function:

Use a schema library (Pydantic, Zod, Marshmallow) for anything beyond trivial validation.

Use parameterised queries (covered in detail in databases-and-sql):

A response has three parts: status code, headers, body. The framework usually handles the headers for you:

Most endpoints need to confirm the requester is logged in and then verify they own the resource they are touching. A simple decorator pattern works well in Flask: the decorator authenticates the request and attaches the user identifier so the handler can use it directly.

The complete login endpoint below combines routing, request parsing, input validation, parameterised SQL, hashed password verification, token issuance and correct status codes. This is the standard shape of a back-end endpoint.

Returning the JSON helper alone defaults to 200 even for creations and errors. Set 201 for created, 400 for client errors, 401 for auth, 500 for crashes.

Always parameterise. The single most common cause of breaches.

Validate every field. Set length limits. Reject unexpected types.

Never log passwords, tokens or full credit card numbers. Logs leak. :::