3 ms·
> there is no security benefit to filtering out unneeded url parameters. there is - security in depth. If a url parameter would've been a vulnerability becaus
by chii 5mo ago
> there is no security benefit to filtering out unneeded url parameters.
there is - security in depth.
If a url parameter would've been a vulnerability because something lower down the stack misinterprets it (and the param wasn't necessary for your app in the first place), then you've just left a window open for the exploit.
If the set of url params are known ahead of time (which i claim should be true), then you could make adding unknown params an error.
- nofriend 5mo ago>If a url parameter would've been a vulnerability because something lower down the stack misinterprets it By assumption, you are using this url parameter. So you have a bug where you've forgotten to allow this parameter, which will quickly be discovered in your logs and fixed. Then the vulnerability, which you are thus far unaware of, will quickly be exposed. Those url parameters you are not using cannot hurt you.