Hello! I have finished working on my project, I'm trying to make it now a little more secure. I'm by no means an expert in any of these things but quite opposite. I wanted to ask if my fetch function as well as api is secure enough to prevent any spoofing? This is one of the fetch functions, there's a few similar to this


My fetch in client-sided component

const handleSubmit = async (e: FormEvent<HTMLFormElement>) => {
    try {
      const response = await fetch(`/api/creator/${userId}`, {
        method: "POST",
        headers: {
          "Content-Type": "application/json",
        },
        body: JSON.stringify(character),
      });

      const text = await response.text();
      const data = text ? JSON.parse(text) : null;

      if (response.ok) {
        if (data && data.id) {
          console.log("Character created");
          const newCharacterId = data.id;
          setCharacterId(newCharacterId);
          setBackgroundPath(`/api/card/background/${newCharacterId}`);

          if (selectedFile) {
            await uploadFile(selectedFile, newCharacterId);
          }
        } else {
          console.error("Invalid response data or characterId missing");
        }
      } else {
        console.error(data ? data.error : "An error occurred");
      }
    } catch (error) {
      console.error(error);
    }
  };

My api in /app/api :

export async function POST(request: NextRequest) {
  const userId = request.nextUrl.pathname.split('/').pop();

  if (!userId) {
    return NextResponse.json({ error: 'User ID not found' }, { status: 400 });
  }

  const requestBody = await request.text();
  const { name, description, card, universe, customLink } = JSON.parse(requestBody);

  if (!name || !universe) {
    return NextResponse.json({ error: 'Missing required fields' }), { status: 400 };
  }


  const existingCharactersCount = await prisma.character.count({
    where: {
      userId,
    },
  });

  if (existingCharactersCount >= 5) {
    return NextResponse.json({ error: 'User can only create 5 characters' }, { status: 400 });
  }

  const predefinedUniverses = ['WOW', 'FFXIV', 'DND'];
  console.log('Parsed request body 2:', { name, description, card, universe, customLink });

  if (!universe || (!predefinedUniverses.includes(universe) && universe.length < 3)) {
    return NextResponse.json({ error: 'Invalid universe value' }), { status: 400 };
  }

  try {
    const character = await prisma.character.create({
      data: {
        name,
        description,
        card,
        universe,
        userId,
        customLink,
      },
    });

    const updatedCharacter = await prisma.character.update({
      where: { id: character.id },
      data: { customLink: character.id.toString() },
    });

    console.log('Character created successfully:', character); 

    return NextResponse.json(updatedCharacter, { status: 201 });
  } catch (error) {
    console.error('Error creating character:', error);
    return NextResponse.json({ error: 'An error occurred while creating the character' }), { status: 500 };
  }
}