3 ms·
It's a nice demo. But there seems to be a surprising lack of validation? Seems like anyone can delete any other user, or post as anyone else, etc. Then again, I
by akersten 7y ago
It's a nice demo. But there seems to be a surprising lack of validation? Seems like anyone can delete any other user, or post as anyone else, etc. Then again, I can't read Haskell, so I don't know if there's something preventing that at a higher level than the endpoint logic.
- whateveracct 7y agoDoesn't look like there is. I think the idea is for this to be a nontrivial example of a full-stack Haskell+Nix(Ops) project. The Twitter part is meant to be more familiar that robust. It's fair to argue auth should be included in a nontrivial example though. I honestly don't think it would add that much clutter either. Although unlike the other components, I don't know if there's a simple off-the-shelf Haskell solution for auth.
- wyager 7y agoServant (the typed routing system being used here) has pretty awesome and robust authentication support. I bet it could be added without too many additional lines.