3 ms·
> One of the nice things about statically generated sites is that you can deploy anywhere (such as S3) without minimal operational complexity. Fair point. I wa
by ebbv 12y ago
> One of the nice things about statically generated sites is that you can deploy anywhere (such as S3) without minimal operational complexity.
Fair point. I was not entering any hosting concerns into the equation, only the behavior of the system as a whole.
- icebraining 12y agoCaching is not the same, since if the page isn't in the cache - and it's often easy to find one that isn't -, the request will get passed on to the generator, which (vastly) increases the attack surface of the whole system.
- ebbv 12y agoCome on, that's like saying brakes don't work because if you don't press them then your car doesn't stop. Of course if you're concerned about this you'd make sure every page is current int he cache.
- icebraining 12y agoThen the attacker does a POST instead, which the caching layer passes on, and your work was for naught. I'm sure it's possible in theory to prevent all kinds of attacks, but it's not like not pressing the breaks, more like trying to plug every hole in a sieve. The tool just isn't built to help you do that.