Reducing Cross Site Scripting Chances #238
evanlurvey
started this conversation in
Ideas
Replies: 1 comment 2 replies
-
Also worth noting the signature method like a JWT or even just using a JWT could work also but that doesn't solve the potentially sensitive form field data going over the wire. |
Beta Was this translation helpful? Give feedback.
2 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
I want to start with I really like how forms are done in solid start. I think the whole project is super cool and I am actively building with it.
When playing with it I noticed that when javascript is disabled and a post is submitted a redirect containing encoded form data and errors comes back. For example try this link with the with-auth example project. You will see the error message has been tampered with. Some also say sensitive form data going over the wire in params is not desired typically.
I was thinking an easy way to solve this problem would to be some form of encryption with a secret that is generated at project creation, similar to how Django does their framework.
While on the topic of security since the forms are built in I think some type of csrf preventative should be encouraged in the docs if not standard in the framework.
Beta Was this translation helpful? Give feedback.
All reactions