JSON | Nalar

Cybersecurity 11 Sep 2026 8 min read

Reject Duplicate JSON Keys at Security Boundaries

JSON looks simple enough that teams often treat parsing as a solved problem. A payload arrives, a library turns it into an object, validation runs, and the application uses the result. That model breaks when an object contains the same member name more than once. Different parsers, frameworks, gateways, signature layers, and application components can resolve duplicate names differently. One component may keep the first value, another may keep the last, and another may reject the payload. If a security decision is made using one interpretation and an action is performed using another, the gap becomes a security boundary failure.

Cybersecurity Application Security

Database 08 Sep 2026 7 min read

Store JSON Faster with SQLite JSONB

I like SQLite’s JSON functions because they let me keep a small amount of flexible data without immediately turning every property into a column. The trade-off is easy to miss: if I store JSON as text, SQLite has to parse that text before it can navigate the structure. Since SQLite 3.45.0, there is another option. SQLite can persist its binary JSON representation, called JSONB, directly in a BLOB. Here’s the idea: if the database is going to inspect the same JSON repeatedly, I can let SQLite store the representation it already wants to process instead of making it parse the text again.

Database SQLite

Go 07 Sep 2026 7 min read

Reject Unknown JSON Fields in Go API Requests

Go makes it pleasantly simple to decode JSON into a struct. That convenience also hides a compatibility decision that matters at API boundaries: by default, fields that do not map to the destination struct are ignored. For internal data this can be useful. For an HTTP request, it can turn a typo into a silent behavior change. A client may send "expires_inn": 3600 while the server expects "expires_in". The JSON is valid, decoding can succeed, and the server may continue with a zero value or a default. The caller receives no direct signal that the field it thought it supplied was never used.

Golang JSON

Go Updated 02 Sep 2025 3 min read

Pretty-Printing JSON in Go with MarshalIndent

Compact JSON is efficient for transport, but long documents can be difficult to inspect when everything appears on one line. Go’s standard encoding/json package includes json.MarshalIndent for producing human-readable JSON with line breaks and indentation. Pretty-printed JSON is useful for debugging, generated configuration, logs intended for people, and command-line output. 1. Use json.MarshalIndent package main import ( "encoding/json" "fmt" ) func main() { data := map[string]any{ "name": "Alice", "age": 30, "address": map[string]string{ "street": "123 Main St", "city": "Wonderland", }, "hobbies": []string{"reading", "hiking", "coding"}, } prettyJSON, err := json.MarshalIndent(data, "", " ") if err != nil { fmt.Println("Error:", err) return } fmt.Println(string(prettyJSON)) } MarshalIndent accepts three arguments:

Golang JSON