4 ms·
I said this on a thread complaining about SPAs a little bit ago, but I love that the SPA trend has caused all kinds of web apps to open up APIs to their users.
by dec0dedab0de 5y ago
I said this on a thread complaining about SPAs a little bit ago, but I love that the SPA trend has caused all kinds of web apps to open up APIs to their users. It's not as fun as pure screen scraping, but it is very exciting when you figure out whatever weird behavior they're expecting, and it starts working.
If you get stuck, look at their javascript, see what it is doing. double check your network requests in developer tools, some of them might be more important than you think, plus it's so nice that we don't have to use burp for this anymore. Some sites check referrers, and user agents, or expect a field from a specific server rendered page to be added to a header. More than one expected a javascript style timestamp on every request.
The weirdest behavior comes from older apps that started as purely server rendered, and slowly added a dynamic frontend. I always cringe when it's obvious that different developers were given tasks over the years, and completed them without bothering to learn the rest of the system.
- pjmlp 5y agoWe didn't need SPAs for that. Ajax, XML-RPC and SOAP exist since around 1999.
- jaredsohn 5y agoYes, SPAs aren't required but they make it more likely that the site will use AJAX to request data instead of rendering the page with server data PHP-style.
- duxup 5y agoIt is pretty handy. I work on some SPAs and some server side rendered systems. It's so nice to fire up the network tab and see some of the requests right away to troubleshoot. Server side rendered stuff, not so easy. Not impossible and you can always add some debugging, but the nature of SPAs to just call all the things that are easily seen, very nice. And I can use that elsewhere.
- pjmlp 5y agoIncluding the people like myself doing security checks as part of SecDevOps workflows. 99% of the time, not great, everyone codes their connection points as if their beloved JavaScript function is the only caller.
- vsnf 5y agoWhat is the recommended way to not code like this? I always take care to not trust raw user input, and add rate limiting and request size limits. I'm sure there is more I can be doing, but this is not my area of expertise.
- pjmlp 5y ago- Never trust any kind of input without validation. - Assume that the caller might not be a browser, so don't assume anything regardling workflows between calls. - Keep up to date with OWASP, https://owasp.org/ https://owasp.org/
- throwawayboise 5y agoSometimes is is when two or three different products were acquired and then clumsily glued together in a single web UI. You can often spot these by jarring changes in conventions and behavior in different areas of the app.
- klenwell 5y agoAs I started to try to track down government sources of Covid data a couple years ago, I soon discovered this approach was generally much more efficient than consulting any official documentation.
- 8n4vidtmkvmk 5y agolol you think it's different developers but it's just me evolving over 8 years and not bothering to update the old shit