3 ms·
Yeah, the people who put those people into the position to touch server side code are to blame. But then the OP is right: the people having made these code chan
by valenterry 2y ago
Yeah, the people who put those people into the position to touch server side code are to blame. But then the OP is right: the people having made these code changes should really not have touched anything server side or even anything security relevant in the beginning.
- hackernewds 2y agoright*
- benoau 2y agoI agree they should just quit but that requires experience to understand too. By the time they've learned that, they have also learned that client-side access controls are decorative.
- consteval 2y agoThey shouldn't have to - the architecture should be made in such a way that permission checks are done without you specifically having to call them every time. This is the entire reason middleware exists!
- valenterry 2y agoWell, but apparently they let people create the architecture who just shouldn't have touched the backend code. That's the whole point. Since it was not just a single endpoint or so - it was everywhere!