4 ms·
What's the idea solution for this? I would drop a cookie and use that to verify admin privileges on each page. Is that right?
by brador 12y ago
What's the idea solution for this? I would drop a cookie and use that to verify admin privileges on each page. Is that right?
- deleted 12y ago[deleted]
- deleted 12y ago[deleted]
- jessaustin 12y agoFirst, use the correct HTTP verb: POST (or possibly DELETE). Googlebot only GETs. Also as you note, destructive changes should be authenticated, whether by Basic Auth over TLS or the more common cookie tokens.
- Mahn 12y agoAuthentication, POST requests and CSRF tokens, at the bare minimum.
- ben0x539 12y agoFundamentally, authentication when someone tries to delete a thing needs to happen in server-side logic, not on the client side. The rest is flavouring.
- vkjv 12y agoAuthentication should happen server side, but authentication need not happen at the time of delete. When deleting, you should be authorizing and validating, which can safely be done client side... but, if you are doing something server-side (e.g., a delete) you should also be doing it server side.
- TillE 12y agoHTTP is stateless. You need to generate some kind of token that can be checked for each admin action a user takes.
- tlrobinson 12y agoBasically do the exact opposite of everything they did. Doing authentication in client-side JavaScript is an absolute no-no. Using GET requests for things that have side effects (like deleting content) is another.
- Apofis 12y agoDon't authenticate on the client, it's that simple. Authenticate only server side.
- airtonix 12y agoSolution is to use a mature web framework that already solves this. ie. Django.