01 · Before and afterThe pattern
// before: any request field may steer the scope
const projectId = ctx.project?.id ?? req.params.projectId ?? req.body?.projectId ?? req.query?.projectId;
// after: only fields the route actually validated
const { schema } = req.routeOptions;
const projectId = ctx.project?.id ?? req.params.projectId
?? (schema?.body ? req.body?.projectId : undefined)
?? (schema?.querystring ? req.query?.projectId : undefined);02 · Run it on your appThe check
Can a user change whether their own failed action gets logged by adding a parameter to the request?
If the honest answer is no or not sure, this is worth a look before it reaches production.