3 ms·
> Cases 1 & 2 are manageable through url parameters Any URL parameter that isn't signed is going to be modified (Look at me, I'm the CEO now). And if it is si
by svieira 1y ago
> Cases 1 & 2 are manageable through url parameters
Any URL parameter that isn't signed is going to be modified (Look at me, I'm the CEO now). And if it is signed then it can be leaked (web app logs generally log query string parameters, if it's in a link that can be copy-pasted then it can be widely shared by accident, etc.)
> On the other hand, I'm not sure how much I like having #3 work in general
Yeah, that is another potential architecture for the web (kind of like Project Xanadu: https://en.wikipedia.org/wiki/Project_Xanadu https://en.wikipedia.org/wiki/Project_Xanadu). It isn't how the web is currently built, so the real question is "how much of the web should break?"