4 ms·
These attacks work by modifying values, not adding parameters. Sounds like they would still work. Besides, you still have to validate the signature server-sid
by Izkata 4y ago
These attacks work by modifying values, not adding parameters. Sounds like they would still work.
Besides, you still have to validate the signature server-side, so it's not like it's saving any work. Validation just gets split up between generating the signature, a network round-trip, and validating the signature.
- derefr 4y ago> so it's not like it's saving any work The "work" the GP is trying to save here isn't CPU cycles, but rather developer labor — the redundant labor of writing both a form view that describes form inputs, and a form-value schema validator to be called from the controller that receives the form's submitted input values. Generating the signature, and validating the signature, would both be done transparently by middleware components of the framework, with no marginal developer labor required per form.
- Izkata 4y agoDjango forms already do that, and because of product requirements around design everyone I know who has used it has found it more of a pain than just doing the forms directly. You're just going to be in the HTML/CSS anyway to make it look right. Only for internal pages, where we didn't have bother with UI design, was it worthwhile.
- jdkoeck 4y agoNo idea why you're getting downvoted. It seems obvious to me too that you still have to validate server-side, so signing the form validation schema on the frontend is a waste of time.