Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SPAs Are Dead?

leastprivilege.com

Post reply on HN
Print view View original

71–80 of 118 posts

Re: SPAs Are Dead?

#71

Post by fractionalhare »

dkarras wrote: post #31
fractionalhare wrote: post #19

Earlier quoted context omitted.

Which is why you use domain scoping, httpOnly and Secure cookie flags so they can only be read by matching hosts (with greater granularity than same-origin policy) over HTTPS and can’t be read by JavaScript. The Web Storage API does not offer these protections.

They can't be read BUT the browser will send the cookie with every request. If you have an XSS, it is game over. The attacker can just send requests from your browser. Slightly less convenient. You are merely taking away the convenience of the attacker doing the attack manually on his own browser, which he probably doesn't want to do anyways. If he can inject js into your site, he will make your browser send the requ…

I am talking about a much more general class of security than just XSS. You’re making perfect the enemy of good here - yes, of course XSS is not completely mitigated by httpOnly. That was not my point.

My actual point stands, the Web Storage API doesn’t offer the same protections as cookies. Don’t store sensitive data in localStorage, that is emphatically not it’s intended use.

Re: SPAs Are Dead?

#72

Post by ivoecpereira »

shock-value wrote: post #51
jakelazaroff wrote: post #17

Earlier quoted context omitted.

Cookies and JWTs are not alternatives to each other. You can store a JWT in a cookie.

You can also store a JWT in localStorage and require an additional secure signature for it within a cookie (http-only). Best of both worlds.

If doing that, why not go full-mode and store JWT in cookie with http-only flag?

Re: SPAs Are Dead?

#73

Post by yurielt »

hawski wrote: post #55

I hoped that designers learned something and decided to stop the war against their users. I did not hold my breath. To clarify I have nothing against actual web applications like an image editor or a game. However a wiki (I don't appreciate Notion), an online shop or a damned blog should not be one. I want my history, link copying, bookmarking, middle-clicks and Ctrl/Cmd-clicks to work as intended.

>and decided to stop the war against their users The thing is that the question is who are their actual users? Truth is just that we arent the actual users, by we I mean the tech savvy crowd we are a minorityand form what I have seen the majority of the users of notion are happier with they way it has evolved, and at the end of the day notion and places like it are going to follow that, I dont like it but this is usually what the war against their "users" is a byproduct of.

Re: SPAs Are Dead?

#74

Post by fractionalhare »

minhazm wrote: post #36
tmpz22 wrote: post #29

Earlier quoted context omitted.

Chrome extensions can also inject code via a content script and gather local storage data. You can't control what extensions people are running.

That also applies to cookies. Users can run any browser or script to access your site and do whatever they want with the cookies.

No they can’t, refer to the documentation on cookie flags and attributes like httpOnly: https://developer.mozilla.org/en-US/docs/Web/HTTP/Cookies

Re: SPAs Are Dead?

#75

Post by takeda »

Why authors of these blog posts assume that everyone know what the context is? Even if one assume the term is related to computing and technology, there's 4 different things named SPA. Is it that hard to expand the term in the title or in the beginning of the blog to help people quickly decide if they are interested in it or not?

Sorry for the rant, but this is not the first time the article forced me to read it before I could decide if I'm interested in it.

Re: SPAs Are Dead?

#76

Post by dkarras »

shock-value wrote: post #62
dkarras wrote: post #56

Earlier quoted context omitted.

I don't believe it adds any meaningful security that justifies the cost (development, testing, hardening, scaling the state across servers if necessary etc.) With security "more complicated" does not necessarily mean "more secure". Doing it without multiplying the number of ways things can go wrong is deceptively hard.

With this method there is no additional per-user state, fortunately.

Yes, just that with regards to security I've seen to many burned by "it can't hurt" processes. With your suggestion, assuming perfect implementation, I personally can't see where it would help. Like, if attacker can run js in your site, they can just set the cookie as necessary before making requests (if the cookie does not exist already) since that is something they can already do. If the cookie exists (most likely scenario), the browser will send it with each request anyways so no added security there either.

Re: SPAs Are Dead?

#78

Post by austincheney »

CivBase wrote: post #65
austincheney wrote: post #60

A better way to think about it: Who wants SPAs more, UI developers or their users? If the demands of the developers out pace the demands of their users AND those demands primarily determine product design decisions the product is not all designed to benefit the user despite developers pleadings to the contrary. That is a very pronounced example of bias.

Users just want pages to load fast. UI developers (presumably) just want to maximize user happiness. A SPA is just a way to front-load resources for a website so users don't have to re-load redundant resources for each new page. Whether that is actually worthwhile for the user depends largely on how many redundant resources a site has and how many pages a user is likely to request in a single session. SPAs are a situ…

It’s hard to know what users want if those wants are assumed, which serves to reinforce bias.

Re: SPAs Are Dead?

#79

Post by amelius »

adrr wrote: post #70
hawski wrote: post #55

I hoped that designers learned something and decided to stop the war against their users. I did not hold my breath. To clarify I have nothing against actual web applications like an image editor or a game. However a wiki (I don't appreciate Notion), an online shop or a damned blog should not be one. I want my history, link copying, bookmarking, middle-clicks and Ctrl/Cmd-clicks to work as intended.

They work perfectly fine under a SPA. SPA pushes history which lets the back button work and you can bookmark the URls. They have real URLs so you can create tabs. Go look at https://www.target.com/ and see if you can tell difference between SPA and regular web page except for the speed aspect.

If you have a history with multiple pages each with their own URI then it is not a SPA. SPA means "single page application".

Re: SPAs Are Dead?

#80

Post by ccmcarey »

amelius wrote: post #79
adrr wrote: post #70

Earlier quoted context omitted.

They work perfectly fine under a SPA. SPA pushes history which lets the back button work and you can bookmark the URls. They have real URLs so you can create tabs. Go look at https://www.target.com/ and see if you can tell difference between SPA and regular web page except for the speed aspect.

If you have a history with multiple pages each with their own URI then it is not a SPA. SPA means "single page application".

That's not true. Wikipedia [0] has a nice summary:

> A single-page application (SPA) is a web application or website that interacts with the user by dynamically rewriting the current web page with new data from the web server, instead of the default method of the browser loading entire new pages. The goal is faster transitions that make the website feel more like a native app.

[0] https://en.wikipedia.org/wiki/Single-page_application

Post reply on HN