3 ms·
I don't think the author does a good job explaining the security problem, but I believe what they meant is something similar to: text="foo&sendPasswordTo=hacke
by eugenekolo 5y ago
I don't think the author does a good job explaining the security problem, but I believe what they meant is something similar to:
text="foo&sendPasswordTo=hacker"
or
text="foo&admin=1"
You can imagine a potentially dangerous parameter and value being passed.
- zild3d 5y agoThis still seems like a server issue regardless? Using URLSearchParams doesn't mean your server wont see a request with `&sendPasswordTo=hacker`. Sure its nicer on the client side but it doesn't solve the security issue