Fix Shadow API Exposure in Blitz.js

Blitz.js 'Zero-API' layer is a double-edged sword. It abstracts the transport layer, but it also implicitly exposes any function in the 'queries' and 'mutations' directories as a public RPC endpoint. Shadow API exposure occurs when developers assume these functions are internal or private, leading to the leakage of sensitive business logic or over-fetching of PII through auto-generated routes that bypass traditional API gateway visibility.

The Vulnerable Pattern

// src/users/queries/getUserInternal.ts
import db from "db"
// VULNERABLE: Implicitly exposed via RPC.
// No authentication, no input validation, and returns the entire record (including password hash).
export default async function getUserInternal({ id }) {
const user = await db.user.findFirst({ where: { id } })
return user
}

The Secure Implementation

To eliminate Shadow API exposure in Blitz.js, you must treat every file in the queries/mutations folder as a public-facing entry point. The fix involves: 1. Input Hardening: Implementing Zod schemas to strictly define the attack surface. 2. Session Binding: Using resolver.authorize() to ensure the RPC route is not accessible to anonymous crawlers. 3. Data Minimization: Utilizing Prisma's 'select' or 'exclude' patterns to ensure the 'Zero-API' layer doesn't accidentally serialize sensitive database columns like 'hashedPassword' or 'isAdmin' into the public response.

// src/users/queries/getUser.ts
import { resolver } from "@blitzjs/rpc"
import db from "db"
import { z } from "zod"
const GetUser = z.object({
id: z.number(),
})
export default resolver.pipe(
resolver.zod(GetUser),
resolver.authorize(), // Guard the endpoint against unauthenticated RPC calls
async ({ id }) => {
const user = await db.user.findFirst({
where: { id },
select: { id: true, name: true, email: true }, // Explicit projection to prevent data leakage
})
if (!user) throw new Error(“User not found”)
return user
}
)