13 ms·
Slick and a nice UI, but the security advice in this is just plain terrible. Blacklist input validation as defense against XSS? Are you kidding me? And then ov
by billyhoffman 11y ago
Slick and a nice UI, but the security advice in this is just plain terrible.
Blacklist input validation as defense against XSS? Are you kidding me? And then over to session fixation, where I see the exact same ?jessionid=blah example that has been in any Web Security book for the last 10-15 years? Come on!
- Dowwie 11y agoThis isn't constructive. Why don't you share your insight with the author rather than simply criticize the content?
- laumars 11y ago> Blacklist input validation as defense against XSS? Are you kidding me? Where are you seeing that? The advice I can see talks about escaping HTML rather than blacklisting input validation: https://www.hacksplaining.com/prevention/xss-stored https://www.hacksplaining.com/prevention/xss-stored Unfortunately it doesn't discuss escaping Javascript nor CSS. But it least it covers the most common case.