3 ms·
True, but just because you trust someone to access the dashboard doesn't mean you trust them to execute code on your server. There are other things to consider
by anglebracket 13y ago
True, but just because you trust someone to access the dashboard doesn't mean you trust them to execute code on your server. There are other things to consider as well, like MITM attacks, and that an XSS hole would let the attacker set their own cookies.
The data in the cookies is just JSON, right? If json.loads() would work here you should switch to that instead.
- k3oni 13y agoGood point there, i'll look into limiting the eval(). I would hope that people won't give access to everyone to the dashboard, wasn't really build for that, or at least that wasn't my initial idea.