3 ms·

You arguably should not be using HTML event handler attributes (1) you should arguably disable eval to help prevent code injections vs CSP. Turning that on dis

You arguably should not be using HTML event handler attributes (1) you should arguably disable eval to help prevent code injections vs CSP. Turning that on disables HTML event handler attributes as those are strings that are "eval"ed https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP (2) using event handler attributes or the JS equivalent (elem.onclick = somefunc) is not very forward thinking as only one handler can be assigned. Sure, you tell yourself "Well, I'm only using one handler" ... until you're not. For example you decide to add event tracking or similar functionality and, since you've followed your pattern of using event handler attributes, only the last one to assign its function wins. (3) Its often much easier to add events in code https://jsfiddle.net/jfkds5px/ https://jsfiddle.net/jfkds5px/ Yes, you can assign by attribute (see 2) or you can create HTML text (see 1) (4) this was mentioned in the article but in an event handler, this = the element the listener was assigned to, event.target = the element that was event was triggered on https://jsfiddle.net/8efd4ghb/ https://jsfiddle.net/8efd4ghb/ (5) button in forms submit the form by default. If you don't want that behavior add type="button". No need for event.preventDefault();

cxr 5y ago
> you should arguably disable eval [using CSP] to help prevent code injections Depending on CSP is a smell, just like any time you open a GUI program from the terminal and it spams a bunch of (clearly undesirable) stuff to stdout—or, for that matter, opening the browser console on a given Web page and seeing a bunch of exceptions or other kinds of printf-style debugging spew that shouldn't have gotten checked in. Besides that, using CSP to disable injected content is user-hostile, which is annoying given that the only "justification" for CSP only comes down to Web publishers whose development practices are such a mess that they don't have control over their content (which, due to the normalization of deviance in the world of Web development, means most of them these days). Nowadays, I open up the browser console on pages associated with big name properties (Google, GitHub...), and it's filled with CSP and CORS violations that never should have escaped into production. I think it was better when browsers had status bars and IE put a badge in the corner, e.g. indicating when the current page encountered an error during the execution of a script. It forced publishers to confront the shoddiness of their work and deal with it if for no other reason than out of sheer embarrassment. > button in forms submit the form by default. If you don't want that behavior add type="button". No need for event.preventDefault() That, too, would be user-hostile. Keep your markup semantic so agents can reason about the content on a page. Don't just target incidental behavior.
- emj 5y ago
  Our site has mainly non tech people on it, a large amount of those have browsers that inject js/css into our HTML, I would say that is something user hostile. When we tested CSP with report-only I had to stop counting at 20 different malwares, the analysis was that even though CSP helps, those malware authors would just find another way. Thousands of our users were affected. Do you think HTTPS is user hostile as well, not being able to read all the network traffic generated on my machines feels off for me. In the end I guess HTTPS is good for the user and so is CSP.
vgel 5y ago
1. The page described is a license management page without user-generated content, so what purpose would a CSP serve besides preventing valid end-user fiddling? 2. YAGNI, in my experience. 3. That's a lot more code than onsubmit="handler(event)", and you've lost the ability to see what the form is doing by reading the HTML. 5. type=submit is semantic and helps the browser provide default behavior like submitting the form when you press enter.

cxr 5y ago

> you should arguably disable eval [using CSP] to help prevent code injections Depending on CSP is a smell, just like any time you open a GUI program from the terminal and it spams a bunch of (clearly undesirable) stuff to stdout—or, for that matter, opening the browser console on a given Web page and seeing a bunch of exceptions or other kinds of printf-style debugging spew that shouldn't have gotten checked in. Besides that, using CSP to disable injected content is user-hostile, which is annoying given that the only "justification" for CSP only comes down to Web publishers whose development practices are such a mess that they don't have control over their content (which, due to the normalization of deviance in the world of Web development, means most of them these days). Nowadays, I open up the browser console on pages associated with big name properties (Google, GitHub...), and it's filled with CSP and CORS violations that never should have escaped into production. I think it was better when browsers had status bars and IE put a badge in the corner, e.g. indicating when the current page encountered an error during the execution of a script. It forced publishers to confront the shoddiness of their work and deal with it if for no other reason than out of sheer embarrassment. > button in forms submit the form by default. If you don't want that behavior add type="button". No need for event.preventDefault() That, too, would be user-hostile. Keep your markup semantic so agents can reason about the content on a page. Don't just target incidental behavior.

emj 5y ago
Our site has mainly non tech people on it, a large amount of those have browsers that inject js/css into our HTML, I would say that is something user hostile. When we tested CSP with report-only I had to stop counting at 20 different malwares, the analysis was that even though CSP helps, those malware authors would just find another way. Thousands of our users were affected. Do you think HTTPS is user hostile as well, not being able to read all the network traffic generated on my machines feels off for me. In the end I guess HTTPS is good for the user and so is CSP.

vgel 5y ago

1. The page described is a license management page without user-generated content, so what purpose would a CSP serve besides preventing valid end-user fiddling? 2. YAGNI, in my experience. 3. That's a lot more code than onsubmit="handler(event)", and you've lost the ability to see what the form is doing by reading the HTML. 5. type=submit is semantic and helps the browser provide default behavior like submitting the form when you press enter.