Live data from Hacker News

JavaScript Security Cookbook

github.com

11–18 of 18 posts

Re: JavaScript Security Cookbook

#11
This smells of an AI generated book. A bunch of recipes, no personal input from the writer, no personal experience or advice or insight. A bunch of howto's with massive consistency in presentation and length. Highly unusual for human produced content.

Actual text is less than one page...

Re: JavaScript Security Cookbook

#12
post #11

This smells of an AI generated book. A bunch of recipes, no personal input from the writer, no personal experience or advice or insight. A bunch of howto's with massive consistency in presentation and length. Highly unusual for human produced content. Actual text is less than one page...

Poorly generated AI cover art...

SEO spam centric blog posts...

https://www.rajamsr.com/blog/

Re: JavaScript Security Cookbook

#13
post #5

Help!! My Web site runs on Windows. Nearly all the code is in Visual Basic.NET (VB) with some code in C accessed via Platform Invoke. For building the Web pages there is use of ASP.NET (active server pages). There is some use of ADO.NET (ActiveX Data Objects) for operations on relational database (currently SQL Server). What is sent to a user is just some HTML code with, optionally, a little JavaScript (JS) code writ…

It cannot. Even if you use JavaScript to try to limit what the browser allows the user to do, anyone can send an HTTP request to your server with absolutely arbitrary content. Only your server can determine if the input is reasonable and legal. However, sticking some extra protection on client-side can help users avoid accidentally sending bad data, or can help save a round trip to the server to find out if some data…

Thanks!

Extra round trips -- yes, the page I send back to the user will not be 100% waste since that page gets to have another collection of ads. For the server load and Internet data rate, good news would be when need more of those two!

In a sense, the round trip can help make the user interface (UI) easier for the user: The dialog can be really explicit and easy for nearly every candidate user in the world to understand immediately effortlessly. In contrast, an active UI based on a lot of JavaScript will look unique and need some thought, trials, and experience by the user. My UI is built with links, single line text boxes, and push buttons -- ancient controls billions of people understand. And the Web pages are in a hierarchy that people can understand easily because it is natural.

I'd likely prefer to minimize the JavaScript I send to a user and have my main software run only on the server side -- all in one place instead of distributed around!

You mentioned the issue of quality for software from someone else: Reasons I'm going with Microsoft are that (a) they actually do know how to write and document software tools and (b) everything my Web site is asking of those tools the tools have long since done successfully at thousands of Web sites.

While I've done a lot of programming, etc., this is my first Web site. Thanks!

Re: JavaScript Security Cookbook

#14
post #11

This smells of an AI generated book. A bunch of recipes, no personal input from the writer, no personal experience or advice or insight. A bunch of howto's with massive consistency in presentation and length. Highly unusual for human produced content. Actual text is less than one page...

Definitely agree

All of the examples added in a single commit, with no changes afterward

“Passable” examples all use a library of some kind

Thorough comments that are mostly irrelevant

Re: JavaScript Security Cookbook

#15

Is there some way to stop browsers (and browser extensions) from injecting JavaScript into a website? I don't think there is, but wanted to ask. I normally set script-src 'none' in my Content Security Policies (HTTP header and HTML meta tag) because I do not use JavaScript, but that does not stop an extension from removing that header/tag and injecting JS. Does anyone know if this is possible?

Other sites, yeah... extensions, not so much... extensions are things the user wants (or at least seems to want) to include. Poorly written extensions aren't great but it's a user issue. Could you imagine, for example, the NYT being able to disable your ad blocker extension?

Re: JavaScript Security Cookbook

#17

Is there some way to stop browsers (and browser extensions) from injecting JavaScript into a website? I don't think there is, but wanted to ask. I normally set script-src 'none' in my Content Security Policies (HTTP header and HTML meta tag) because I do not use JavaScript, but that does not stop an extension from removing that header/tag and injecting JS. Does anyone know if this is possible?

Other sites, yeah... extensions, not so much... extensions are things the user wants (or at least seems to want) to include. Poorly written extensions aren't great but it's a user issue. Could you imagine, for example, the NYT being able to disable your ad blocker extension?

Yes, good point. I was not thinking of it from that perspective. It's a client issue, I'll stop worrying about it.

Re: JavaScript Security Cookbook

#18

There's nothing talking about Javascript dependency hell. This is one of the reasons why I don't use JS in the backend.

What do you mean it's not a good idea to import `is-even` for your server side logic??

Software dependencies: The silent killer behind the world's biggest attacks.
Post reply on HN