3 ms·
This is a risk common to all "fat clients", when the same team develops both the server code and the client code: it's easy to forget that, unlike the server co
by cesarb 2y ago
This is a risk common to all "fat clients", when the same team develops both the server code and the client code: it's easy to forget that, unlike the server code, the client code cannot be trusted.
- treyd 2y agoI don't really understand how this is so hard to get. Is this a phenomenon of using "full stack JS" for everything and tools that intentionally try to hide the boundary between client and server? If that's the case then why are the tools designed to cause those problems?
- hoten 2y agoIt's a tale as old as time - not all developers understand the abstractions they work under.
- th3w3bmast3r 2y ago^ This and also taking a shortcut is easier. For teams that are not full-stack, doing it client-side means you don't have to bother the backend team for more APIs or wait for them to implement it fo you.
- JoshTriplett 2y agoLack of security mindset. It's important to have the fundamental habit of assuming that every surface area you expose could receive arbitrary inputs and will not necessarily only interact with code you've written. But that's not an innate thing that everyone knows without explicit learning/training.