nchmy

19 ms·

451.
by nchmy 10mo ago
Sec fetch has 98% browser coverage now. You can fall back to origin, which has 100% coverage. Non-browser clients can be either blocked or even just given a pass, since CSRF is about tricking someone into clicking a link that then sends the
452.
by nchmy 10mo ago
Fetch Metadata headers, as discussed in this post, are just as simple and much more effective. There's lots of issues with referer, and even some with origin.
453.
by nchmy 10mo ago
I don't know why I said same-site cookies have nothing to do with csrf. They can be helpful as defense in depth, but not primary defense.
454.
by nchmy 10mo ago
98% coverage if you exclude browsers that caniuse doesn't track (which is surely appropriate, since even things like checkbox elements have only 96% coverage if you include un tracked browsers). And you can fall back to origin header,
455.
by nchmy 10mo ago
But that's not what owasp argues. Fetch Metadata is recommended as a primary, standalone defense against CSRF (you can be forgiven for not knowing this - I worked on getting the doc updated and it landed a couple weeks ago, then was re
456.
by nchmy 10mo ago
Or wsl2
457.
by nchmy 10mo ago
Sorry, I misread your comment
458.
by nchmy 10mo ago
It's a shame you talked about browser tampering, since better caching is indeed a benefit of fetch metadata headers.
459.
by nchmy 10mo ago
Csrf is not dependent on js. It happens via normal links on external sites.
460.
by nchmy 10mo ago
Client side js is not particularly relevant to csrf.
461.
by nchmy 10mo ago
Cs and cors have nothing to do with csrf... Though, yes, neither does same-site
462.
by nchmy 10mo ago
Can you share links to better guidance than OWASP?
463.
by nchmy 10mo ago
It should be fixed now.
464.
by nchmy 10mo ago
Can you share an example?
465.
by nchmy 10mo ago
You're probably looking for something that is more focused on specific software decisions/implementations, but https://infrequently.org is the best web development blog out there. It's not "technical" so
466.
by nchmy 10mo ago
why wouldnt it cover client-side redirects?
467.
by nchmy 10mo ago
https://www.w3.org/TR/fetch-metadata/#redirects
468.
by nchmy 10mo ago
that should have been a fair assumption! I hope we can get this sorted out soon
469.
by nchmy 10mo ago
Again, the maintainer eventually came around. Our confusion might be due to the fact that an erroneous PR (by seemingly an AI-wielding student...) was somehow recently accepted that completely reverted the changes we collectively worked on,
470.
by nchmy 10mo ago
As someone who was involved in these changes to the OWASP cheat sheet, I'm glad to see this getting implemented in the wild, as well as for the nice blog post about it all. However, one point of clarification > Several participants
471.
by nchmy 10mo ago
I was involved in the effort to add/upgrade Fetch Metadata in the OWASP cheat sheet. We had discussed GET requests, so if you find the guidance lacking about it, please let us know how. Likewise, if you could elaborate on the open redi
472.
by nchmy 10mo ago
Signals aren't even really "rendering". And react and spas dont have a monopoly on doing things on the client - that's just javascript. I dare you to go to the datastar discord and tell them that they're React-adjac
473.
by nchmy 10mo ago
its also smaller and faster
474.
by nchmy 10mo ago
I assume youre referring to the "starfield" on the home page. That's just showcasing their "Rocket" webcomponents tool, which makes it vastly simpler to make WCs. It is otherwise a very simple website, and the frame
475.
by nchmy 10mo ago
To clarify, there's nothing React or SPA about datastar. Moreover, HTMX v4 is essentially Datastar-lite (but heavier, and less capable)
476.
by nchmy 10mo ago
That somehow feels like an insult! Keep up the great work
477.
by nchmy 11mo ago
What I'm most interested is not usage of "gotten", but whether somewhere in the English-speaking world, using "I've" standalone (without a follow-on got, been, had etc) is normal. I see it from time to time onl
478.
by nchmy 11mo ago
Jjui is incredible. I keep shouting it from every rooftop that I find. So good, in fact, that I'd argue it should be made an official TUI
479.
by nchmy 11mo ago
I really thought that cookstoves would be safe from hacker news' erroneous self-importance and condescension, but here we are. You've evidently never left your ivory tower to live in a sheet metal (or worse) shack, which a signifi
480.
by nchmy 11mo ago
This is the sort of comment I was hoping to find. I have focused in this area - improving lives of the poorest as efficiently as possible - for a long time and my immediate thoughts about this washing machine was that it was overcomplicated

More ›