4 ms·
Actually, I wasn't picking on it because it's MS, I'm picking on it because it breaks bookmarking, hyperlinking (leave a page open long enough and links stop wo
by rdoherty 17y ago
Actually, I wasn't picking on it because it's MS, I'm picking on it because it breaks bookmarking, hyperlinking (leave a page open long enough and links stop working), sharing links and reloading pages.
It also avoids the real solution of simply validating and escaping user-entered data, a much more common and secure method of preventing XSS exploits.
- tptacek 17y agoAgain: it breaks those things overtly and deliberately, for applications that don't care about those things. We need to snap out of the meme that internal enteprise apps are built to the same community standards as Wikipedia and Amazon Web Services. A lot of internal apps are just HTML forms hooked up to databases, replacing ancient VB MFC applications that only run on Windows. Stop penalizing VB developers for trying to get their stuff working in a browser without exposing all their data.
- johns 17y agoExcept that there are better ways to accomplish those goals AND get the benefits of a web app. I don't fault any enterprise devs for trying to get stuff working and I understand they have a different set of working requirements than someone working on a consumer web app. I do fault MS for putting out "guidance" like this that will just be a waste of resources and a maintenance nightmare for corporate devs that don't know any better.
- tptacek 17y agoI don't disagree even a little. I'm just pushing back on "here's an example of Microsoft being crazy".