3 ms·
Kinda really. This entire class of security lapse can be avoided by not building a js app on the client.
by zach_garwood 5y ago
Kinda really. This entire class of security lapse can be avoided by not building a js app on the client.
- gcommer 5y agoPlenty of server-rendered apps have been caught putting private data in responses. In this very same comment section people have mentioned the story of a state website that included teacher SSN's in hidden fields[1], and OJFord shared a story of a server that included a full env var dump in error messages[2]. This sort of thing happens all the time to all sorts of services. Rather than just blaming JS, it's far more productive to think of technical controls that could catch this. For example Taint Checking[3] or scanning server responses for API keys. [1]: https://news.ycombinator.com/item?id=31026374 https://news.ycombinator.com/item?id=31026374 [2]: https://news.ycombinator.com/item?id=31026415 https://news.ycombinator.com/item?id=31026415 [3]: https://en.wikipedia.org/wiki/Taint_checking https://en.wikipedia.org/wiki/Taint_checking
- deleted 5y ago[deleted]
- speedgoose 5y agoYes I guess if you don’t build apps you have fewer security issues.