3 ms·
Well you sure as shit aren't going to see "hoodie.account.signUp(username, password);" in Gmail's client-side code. Gmail's code base is not a "offline first,
by billyhoffman 12y ago
Well you sure as shit aren't going to see "hoodie.account.signUp(username, password);" in Gmail's client-side code.
Gmail's code base is not a "offline first, mobile first" platform. The API that is exposed to the client-side is fairly light (watch the traffic).
I highly suggest use research "business logic flaws" in web apps. Anything Jeremiah Grossman has said on this topic is good stuff.
- janl 12y agoThey have frontend code that will talk to /singup or whatever the route for creating an account is. Hoodie does nothing different. Thanks for the pointer to Jeremiah, though :)
- pokstad 12y agoCan you give an example for why that signup code is bad? In the case that I'm using Hoodie with CouchDB, wouldn't Hoodie just AJAX post a user document to the CouchDB _users database (which is a good implementation)? All of the access control would be in the hands of the server with minimal (if any at all) security logic in the front end.
- onezerozeroone 12y agoYeah, but you're going to see a <form> that POSTs to some target URL, with username and password as fields. The only thing protecting the plaintext password from leaking is SSL. POSTing a XmlHttpRequest is equivalent.
- camus2 12y agothe signup seems to be handled by couchdb.