3 ms·
Sanitization and protection from attacks is handled by the API itself instead of the client. We feel it's inherently risky to rely on the client at all for any
by courtneycouch0 14y ago
Sanitization and protection from attacks is handled by the API itself instead of the client. We feel it's inherently risky to rely on the client at all for any security.
- davekt 14y agoThanks for responding. I would argue the opposite, that the browser is the safest place to sanitize because it better understands the context where user generated strings will be inserted. An example where the server may not understand the correct context occurs in this utf7 attack (http://html5sec.org/#charset http://html5sec.org/#charset). The server sanitizes the user input as utf8 where it passes. The client forces the browser to interpret the input as utf7 instead, and the string that was harmless as utf8 now becomes active js.
- tipiirai 14y agoThank you for this good example. We'll study this one more closely.