3 ms·
>- sanitizing input Oh, that unicorn that everybody takes about, yet nobody does anything with it So, how do you sanitize input? you save in database escaped
by tester34 5y ago
>- sanitizing input
Oh, that unicorn that everybody takes about, yet nobody does anything with it
So, how do you sanitize input?
you save in database escaped strings?
allow only "english" letters?
>- HTML injection
>- XSS
those two belong to
>- Escaping output
don't they?
>- Various timing attacks (eg password hashing)
>- How to store passwords
just use state of art auth/login handling libs?
>- DDoS and other resource exhaustion attacks
I don't think I'd add it there, isn't it handled by firewall / infrastructure than app directly?
- giu 5y ago> I don't think I'd add it there, isn't it handled by firewall / infrastructure than app directly? Although most DDoS attacks happen on the layers 3, 4, and 6 of the OSI model, your application still has to be hardened against resource exhaustion and other DDoS attacks. For example, if you have a REST endpoint that starts a complex query which might return a large result given some specific query parameters (e.g. your limit parameter is not bound, so I can set limit=1000000), running 10000 requests against it from different hosts (malicious or not) may bring down your database server.
- tester34 5y agoYou're right, thanks for reminding