3 ms·
This is a pretty good laundry list of things you shouldn’t return in an api and why. I’m sure it will be instructive to folks. What’s a bit scary is that depen
by jasonjmcghee 3y ago
This is a pretty good laundry list of things you shouldn’t return in an api and why. I’m sure it will be instructive to folks.
What’s a bit scary is that depending on abstraction (ORM / service layer), it could be as simple as the difference of returning User instead of UserResponse.
The engineers could have easily known better and it was a bad autocomplete / model choice with tests that only asserted the needed fields were there.
It’s easy to bash the devs on how egregious this was, but depending on the system very little might need to “go wrong” for this to happen.
Curious what kinds of strategies other folks use to protect against this.
Annotations / lint rules for using models with sensitive data? Tests that check and fail on fields that shouldn’t be there? Comprehensive / sensitive tests for checking for sensitive fields?
- tobiasfuenke 3y agoThe website is a $50 social media clone from CodeCanyon. It's written in PHP and uses MySQLiDB. Additional features were added by programmers on Upwork.
- sdflhasjd 3y agoYou obviously have to be aware that this could be an issue, and extrapolating from some of the code quality found on other parts of the site[0], I don't think they've got the awareness to proactively deal with that sort of thing. [0] - https://pastebin.com/hDdT8vM6 https://pastebin.com/hDdT8vM6 (taken from the signin page)