Security Checklist for Full Stack Web Developers
blog.logrocket.com
Security Checklist for Full Stack Web Developers
1–10 of 14 posts
Re: Security Checklist for Full Stack Web Developers
#2[deleted]
Re: Security Checklist for Full Stack Web Developers
#3> In Node, if you use Express (find out in the next article why you shouldn’t , but most people do)
Now that's just mean. Why can't he just say it there!
Re: Security Checklist for Full Stack Web Developers
#4I'm not sure that logrocket belongs on such a "security" checklist. While I understand the value that they propose to offer, I'm not sure that wholesale recording your users' sessions and then sending them to a third-party server for storage and retrieval really meshes with my idea of security - especially if the site contains PII. I fully understand that you can intentionally do work to hide that information from logrocket, but that is putting a lot of trust in both devs and in logrocket to get that one right.
While there may be such a tool, I'm not aware of something like this that runs as a first party script and uses local storage. It would indeed be very useful to escape the logs->screenshots->can't reproduce cycle mentioned.
Re: Security Checklist for Full Stack Web Developers
#5> In Node, if you use Express (find out in the next article why you shouldn’t , but most people do) Now that's just mean. Why can't he just say it there!
Some more links that are express specific:
https://expressjs.com/en/advanced/best-practice-security.htm...
https://blog.risingstack.com/node-js-security-checklist/
I am also curious to know what's wrong with express.
Re: Security Checklist for Full Stack Web Developers
#6> In Node, if you use Express (find out in the next article why you shouldn’t , but most people do) Now that's just mean. Why can't he just say it there!
[deleted]
Re: Security Checklist for Full Stack Web Developers
#7> In Node, if you use Express (find out in the next article why you shouldn’t , but most people do) Now that's just mean. Why can't he just say it there!
That's where I stopped reading.
Re: Security Checklist for Full Stack Web Developers
#8TL;DR: The advice is:
"use Open source software", "add logging", "set all pages to HTTPS" and follow a "top 10 list of the most critical security threats"
Sad state of things.
The concept of having your work done by "Full Stack Developer" will not be nice for opening up potential security holes, in my opinion.
Additionally, I don't think there exists a real "Full Stack" dev, and I'm not alone in this opinion; click anywhere:
https://medium.com/swlh/the-full-stack-developer-is-a-myth-4...
https://news.ycombinator.com/item?id=10182936
http://andyshora.com/full-stack-developers.html
https://frontendmasters.com/books/front-end-handbook/2017/pr...
https://vitamintalent.com/blog/the-myth-of-the-full-stack-de...
https://techcrunch.com/2014/11/08/the-rise-and-fall-of-the-f...
https://www.propelrr.com/blog/ux/full-stack-web-developer.ht...
Re: Security Checklist for Full Stack Web Developers
#9I'm not sure that logrocket belongs on such a "security" checklist. While I understand the value that they propose to offer, I'm not sure that wholesale recording your users' sessions and then sending them to a third-party server for storage and retrieval really meshes with my idea of security - especially if the site contains PII. I fully understand that you can intentionally do work to hide that information from lo…
I'm on the LogRocket team.
Your concern is fair, though many modern analytics tools can capture PII if not properly configured. It is important when using any such tools, including LogRocket, that developers understand the scope of the data collected and properly censor things like SSN, Credit Cards, or health data.
Some of our more security-conscious customers also just run LogRocket on their own servers with our self-hosted version. In this case, the script becomes first party, and they can configure behavior where no data leaves the client unless a user specifically gives permission.
Re: Security Checklist for Full Stack Web Developers
#10I'm not sure that logrocket belongs on such a "security" checklist. While I understand the value that they propose to offer, I'm not sure that wholesale recording your users' sessions and then sending them to a third-party server for storage and retrieval really meshes with my idea of security - especially if the site contains PII. I fully understand that you can intentionally do work to hide that information from lo…
I'm on the LogRocket team. Your concern is fair, though many modern analytics tools can capture PII if not properly configured. It is important when using any such tools, including LogRocket, that developers understand the scope of the data collected and properly censor things like SSN, Credit Cards, or health data. Some of our more security-conscious customers also just run LogRocket on their own servers with our se…
That is awesome to hear that there is a self-hosted version. I was reading through your docs hoping to find something like that. Is there somewhere on your site that I missed which gives more details about this?