When announcing a web framework can we please: - Include a warning if you don't handle common attacks for browser based applications by default - Include a substantial example application? At least a blog or a todo app? How do I use a conn pool? Can I convert LibErrror into 404?
-
I guess I need to add a sample application for
@luckyframework :P BTW, what would you classify as common attacks? SQL injection? XSS? Just wondering what constitutes common in your eyes.
Depends on the scope of a web framework. CSRF and Session hijacking/fixation for sure. CSRF protection should still be token based not just header based. If DB access is involved, then yes SQL injection. If templating is involved then yes XSS
-
-
Perfect. That’s what I was thinking. Thanks for the fast response :)
-
Any time. Feel free to ping me on Lucky stuff if you'd like, I've spent a lot of time working on these sorts of issues.
- 1 more reply
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.