5 ms·
I saw a $12 million app have to be essentially rewritten (at a bank) The “genius dev lead who went to Princeton” kept pushing that they went to Princeton so pe
by anon223345 4y ago
I saw a $12 million app have to be essentially rewritten (at a bank)
The “genius dev lead who went to Princeton” kept pushing that they went to Princeton so people stopped arguing against it
Tried to do this securely and got pwned in the very first demo
- winrid 4y agoI mean, they got pwned because they didn't validate the state against the current user's session. Not because storing state in the URL is insecure.
- didericis 4y agoIf you’re validating client url state against server session state that kind of defeats the purpose of trying to put all the state in the url. You’re technically correct/sounds like you agree it’s still a bad idea, even if there’s a way to duplicate certain state for validation and make it work. Staying shackled to the earth via stupid rules of thumb like minimizing client state in banking apps does keep you from flying straight into the sun, though, which is nice.
- forgotusername6 4y agoHow can you secure state stored in the URL?
- winrid 4y agoYou don't. You secure the resources the state accesses.