4 ms·
"more error prone and less safe" right there... if I could vote you up a thousand times, I would. I can place a bet that most home grown apps have no security
by thrownaway954 8y ago
"more error prone and less safe"
right there... if I could vote you up a thousand times, I would. I can place a bet that most home grown apps have no security measures against CSRF or XSS in place.
- sheeshkebab 8y agoMost modern apps use api/json based endpoints where csrf is not needed (cookies are no longer used for auth) and xss is massively simplified since html is rarely returned by backend. In other words most web frameworks that help with rendering html on the server and writing forms to database are not needed either.
- klodolph 8y agoCRSF is not an issue for JSON API endpoints, since cross-origin requests are disabled by default. XSS in my experience is best solved by a reasonable templating language. The same way you don't use string concatenation to insert user data into HTML documents, you don't use string concatenation to insert user data into SQL queries. Frameworks don't add anything here that you don't already have, and a lot of frameworks let you choose your templating system anyway. This was a big reason to use frameworks in past days, though.