3 ms·
This problem just means a better implementation of RJS is required, or of any other technology that similarly tries to abstract away the client-server divide wi
by vorg 14y ago
This problem just means a better implementation of RJS is required, or of any other technology that similarly tries to abstract away the client-server divide with a high-level concept.
- yuliyp 14y agoNo. Abstracting away the client-server divide in web apps is a broken concept. The server runs in a trusted environment. You can trust the results of decisions it makes ("can the user write to this object?", "can the user see this object"). You can never trust the results of decisions client-side code makes, except insofar as they are a proxy of the intentions of the authenticated user on the other side of the interaction.
- reeses 14y agoI think 'abstraction' is the wrong term anyway. It has become a go-to term for "make the ugly go away."
- homakov 14y agoWell i got to disagree. If server responds "yes you can write to this object" client can represent form for writing but when he submits this form it depends on the server again. Client should not trust server as well. If server goes mad it still can be not compromising client-side (unless app was completely hacked and HTML was changed)