StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>In general, it's OK to post whatever data to the browser. But don't forget:</p> <blockquote> <p>Any data passed to the client and passed back to the server might be <strong>compromised in any way</strong>. Don't trust data returned by the client!</p> </blockquote> <p>Unfortunately, if you post keys - somehow - the user changes it and you fail to correctly verify the key, if posted back from client to server, harmful things might happen.</p> <p>Thus, you should write very defensive code regarding client-to-server-post/get keys. In fact, you shouldn't trust any data posted back from client to server.</p> <p>My <a href="https://stackoverflow.com/questions/6783575/best-method-to-verify-multi-level-relational-dependencies">question</a> might be of interest too.</p> <p>As stated in my question, my latest application never ever posts identifying data to the client. More generally, <strong>not even those stuff typically used as parameters in GET/POST parameters ever get written to the client</strong>. </p> <p>All keys or somehow entity related attributes which control the flow of the application are strictly server-side only.</p> <p>What I proposed as alternative D) in my <a href="https://stackoverflow.com/questions/6783575/best-method-to-verify-multi-level-relational-dependencies">question</a> provides this:</p> <ul> <li>Any <strong>request</strong> received by the server is <strong>valid by default</strong>, since all valid link gets born at <strong>page-rendering time</strong>, rather than at request time.</li> <li><strong>User can't forward links</strong> using email or post them, since they only exists while his or her session is active.</li> <li>User <strong>can only request those links inside a web-page</strong>, since only these links are registered at the server-side. </li> <li>All <strong>state related data is keep at the server side</strong>, and thus unchangable by the client.</li> </ul>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload