Ask HN: Can Jasmine Unit Tests Expose Security Vulnerabilities on Server?

Post by jbrowne » Thu, Feb 13, 2014, 5:12 AM UTC

barylen wrote: post #10

jbrowne wrote: post #3

Earlier quoted context omitted.

Thanks for responding! Currently running Jasmine on local dev box, yes that's cool, sysadmin not concerned about that. We don't have CI server. We have a dev server that is currently exposed to the world, our production server is separate. If Jasmine installed on the dev server a SpecRunner.html that triggers the unit tests on that dev server could be accessed by anyone if they knew the url. This is what the sysadmin…

Your dev server shouldn't be accessible to the public. If you want a server to be accessible to the public that isn't your production server (which is valid), you should be doing things as similar to production as possible (not running tests on it).

Post by staunch » Thu, Feb 13, 2014, 6:10 PM UTC

jbrowne wrote: post #9

staunch wrote: post #8

You shouldn't be unit testing on production. You should run as little as possible in prod.

Thanks for responding staunch! Is that mainly to avoid performance costs/clutter, or for security reasons or both?

Post by jbrowne » Thu, Feb 13, 2014, 7:09 PM UTC

wpietri wrote: post #12

jbrowne wrote: post #11

Earlier quoted context omitted.

Thanks barylen for the response! Totally get what you're saying, could you expand a bit on why?

I agree with barylen. Dev should never be visible. For the general reason that the default is "hidden". You make specific exceptions for the small number of things you want people to see. There are a lot of reasons for that, but for me the two big reasons are good user experience and good security. You get a good user experience by carefully controlling what people see and making sure that's polished. You don't want…