Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #33384

Re: JavaScript code security

Show all headers | View raw

On Tuesday, May 23, 2017 at 10:14:07 PM UTC-4, Stefan Weiss wrote:
> justaguy wrote:
> >> Stefan Ram wrote:
> >>> CREATE UNIQUE INDEX I on TABLE0( FIELD0 );
> > 
> > This approach would generate a db insertion error. I'd prefer to
> > implement server side duplicate data validation to this method. But as
> > mentioned earlier I'd prefer not to implement server side validation.
> 
> Of the three methods to prevent duplicate records mentioned in this thread,
> only the JavaScript part is optional. If you are at all concerned with
> security (and the title of your question suggests that you are), input
> validation on the server side is a must. This is not negotiable. The unique
> constraint in the database is an added safety net (which you should also
> use). It will typically not activate during normal operation, but when it
> does, it can save your data integrity.
> 
> Relying on client side validation alone is the software equivalent of this:
> https://i.imgur.com/bYiIN56.jpg
> 
> 
> Given your description, it's impossible to say what caused your duplicate
> entries. If I had to guess, I would put my money on
> 
>   1) you hit "reload" after a form submit
We can eliminate this one because after form submission it's automatically redirected to another page (eliminating the opportunity of "reload", hence, room for creating duplicate records).

>   2) you made a mistake in your client side checks
This web app been tested on two instances (two servers), the client side check works fine.  Thus, we can eliminate this speculation as well.

>   ........
>   ........
>   42017) somebody hacked your server and decided to mess with you by
>          inserting a duplicate record
This is a possibility.  Since about a week ago, a critical file on the AMAZON AWS server was mysteriously removed. 
 
>   ........
>   43501) aliens
> 

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 13:02 -0700
  Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 13:11 -0700
    Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 17:56 -0700
      Re: JavaScript code security Ben Bacarisse <ben.usenet@bsb.me.uk> - 2017-05-24 02:44 +0100
        Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 19:06 -0700
          Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 09:11 +0200
            Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 05:56 -0700
              Re: JavaScript code security Wally W. <ww84wa@aim.com> - 2017-05-29 14:57 -0400
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-30 09:41 +0200
                Re: JavaScript code security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-06-23 10:53 +0200
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-06-23 13:38 +0200
            Re: JavaScript code security Ben Bacarisse <ben.usenet@bsb.me.uk> - 2017-05-24 14:28 +0100
              Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 18:07 +0200
        Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 06:01 -0700
          Re: JavaScript code security John G Harris <niam@jghnorth.org.uk.invalid> - 2017-05-24 14:19 +0100
            Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 10:01 -0700
              Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 19:18 +0200
                Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 11:39 -0700
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 23:07 +0200
                Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 14:26 -0700
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-25 16:26 +0200
  Re: JavaScript code security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-05-24 01:12 +0200
    Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 17:15 -0700
      Re: JavaScript code security Stefan Weiss <krewecherl@gmail.com> - 2017-05-24 04:14 +0200
        Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 19:47 -0700
  Re: JavaScript code security Myers <xdaamanx@gmail.com> - 2017-05-29 07:54 -0700
  Re: JavaScript code security Myers <xdaamanx@gmail.com> - 2017-05-29 07:55 -0700

csiph-web