3 ms·
I mean, they got pwned because they didn't validate the state against the current user's session. Not because storing state in the URL is insecure.
by winrid 4y ago
I mean, they got pwned because they didn't validate the state against the current user's session. Not because storing state in the URL is insecure.
- didericis 4y agoIf you’re validating client url state against server session state that kind of defeats the purpose of trying to put all the state in the url. You’re technically correct/sounds like you agree it’s still a bad idea, even if there’s a way to duplicate certain state for validation and make it work. Staying shackled to the earth via stupid rules of thumb like minimizing client state in banking apps does keep you from flying straight into the sun, though, which is nice.
- forgotusername6 4y agoHow can you secure state stored in the URL?
- winrid 4y agoYou don't. You secure the resources the state accesses.