Fix Insecure API Management in Cuba

const express = require('express');
const app = express();
// VULNERABLE: No authentication, no rate limiting, and direct IDOR vulnerability
app.get(‘/api/v1/consultar-pago/:id’, (req, res) => {
const query = SELECT * FROM payments WHERE id = ${req.params.id};
db.query(query, (err, result) => {
if (err) throw err;
res.json(result);
});
});

const express = require('express');
const rateLimit = require('express-rate-limit');
const { authenticateJWT } = require('./authMiddleware');
const app = express();
const apiLimiter = rateLimit({
windowMs: 15 * 60 * 1000,
max: 100,
message: ‘Too many requests from this IP.’
});
// SECURE: Rate limiting, JWT verification, and parameterized queries
app.get(‘/api/v1/consultar-pago/:id’, apiLimiter, authenticateJWT, async (req, res) => {
try {
const paymentId = req.params.id;
const userId = req.user.id;
// Prevent IDOR by ensuring the user owns the record
const [rows] = await db.execute(
  'SELECT amount, status, date FROM payments WHERE id = ? AND user_id = ?',
  [paymentId, userId]
);

if (rows.length === 0) return res.status(404).json({ error: 'Record not found' });
res.json(rows[0]);
} catch (err) {
res.status(500).json({ error: ‘Internal Server Error’ });
}
});