4 ms·
I always thought it was done this way to avoid attacks such as XSS, SQL injection and so on. Free text fields are hard to validate and the authentication is usu
by matthiasb 15y ago
I always thought it was done this way to avoid attacks such as XSS, SQL injection and so on. Free text fields are hard to validate and the authentication is usually a very sensitive feature! It seems to be the easy way to be safe (from the developer point of view).
- manveru 15y agoWhy would you need to worry about these at all? The password is supposed to be given to bcrypt, and the result from bcrypt is something that's usually not suitable for attacks on anything. So yeah, it may be sensitive, if you store plaintext passwords, but then that'll be the least of your worries.