5 ms·
Every online form where user can interact and send data back to a server is always a nightmare in terms of security. I do utilize mod_secure, but with my next p
by joering2 5y ago
Every online form where user can interact and send data back to a server is always a nightmare in terms of security. I do utilize mod_secure, but with my next project, I have an idea of doing "base64" on everything in client's browser via javascript then sending it to server and checking on backend if content is a valid base64. Is that a good concept?
- lesquivemeau 5y agoWouldn't prevent XSS afaik
- justinsaccount 5y agoThat could work if you are just going to store things as base64. It accomplishes nothing if you are going to decode the base64 on the backend and then use the original value as-is. If anything it's worse than nothing, because now mod_secure will just see the base64 content and might fail to detect certain attacks.
- afavour 5y agoUnfortunately that wouldn't help with a whole lot. The danger with input is that it could be used to e.g. escape a SQL query and delete your database. Which is why we now have parameterised queries and such to help alleviate those worries. If you think about it the process you're describing already happens: the browser sends the user's input as (usually) UTF8 string data, then the server decodes it. Changing that process to base64 wouldn't change much.
- deleted 5y ago[deleted]
- adrr 5y agoWouldn’t base64ing your inputs bypass mod_security?
- joering2 5y agook thank you everyone for your responses (+1s) - I was research on this idea and couldn't find anything online - now I know why!
- scotty79 5y agoOnly if you never decode it from base64. :)