Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #33383

Re: JavaScript code security

Show all headers | View raw

justaguy wrote:
>> Stefan Ram wrote:
>>> CREATE UNIQUE INDEX I on TABLE0( FIELD0 );
> 
> This approach would generate a db insertion error. I'd prefer to
> implement server side duplicate data validation to this method. But as
> mentioned earlier I'd prefer not to implement server side validation.

Of the three methods to prevent duplicate records mentioned in this thread,
only the JavaScript part is optional. If you are at all concerned with
security (and the title of your question suggests that you are), input
validation on the server side is a must. This is not negotiable. The unique
constraint in the database is an added safety net (which you should also
use). It will typically not activate during normal operation, but when it
does, it can save your data integrity.

Relying on client side validation alone is the software equivalent of this:
https://i.imgur.com/bYiIN56.jpg


Given your description, it's impossible to say what caused your duplicate
entries. If I had to guess, I would put my money on

  1) you hit "reload" after a form submit
  2) you made a mistake in your client side checks
  ........
  ........
  42017) somebody hacked your server and decided to mess with you by
         inserting a duplicate record
  ........
  43501) aliens

Problem (1) can be solved by using the POST-Redirect-GET pattern or using
one-time tokens.
Problem (2) can be solved by fixing your code.
Problem (43501) can be solved by sending Jeff Goldblum to the mother ship
and infecting it with a virus.


- stefan

Back to comp.lang.javascript | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 13:02 -0700
  Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 13:11 -0700
    Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 17:56 -0700
      Re: JavaScript code security Ben Bacarisse <ben.usenet@bsb.me.uk> - 2017-05-24 02:44 +0100
        Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 19:06 -0700
          Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 09:11 +0200
            Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 05:56 -0700
              Re: JavaScript code security Wally W. <ww84wa@aim.com> - 2017-05-29 14:57 -0400
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-30 09:41 +0200
                Re: JavaScript code security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-06-23 10:53 +0200
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-06-23 13:38 +0200
            Re: JavaScript code security Ben Bacarisse <ben.usenet@bsb.me.uk> - 2017-05-24 14:28 +0100
              Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 18:07 +0200
        Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 06:01 -0700
          Re: JavaScript code security John G Harris <niam@jghnorth.org.uk.invalid> - 2017-05-24 14:19 +0100
            Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 10:01 -0700
              Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 19:18 +0200
                Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 11:39 -0700
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-24 23:07 +0200
                Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-24 14:26 -0700
                Re: JavaScript code security "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-05-25 16:26 +0200
  Re: JavaScript code security Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-05-24 01:12 +0200
    Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 17:15 -0700
      Re: JavaScript code security Stefan Weiss <krewecherl@gmail.com> - 2017-05-24 04:14 +0200
        Re: JavaScript code security justaguy <lichunshen84@gmail.com> - 2017-05-23 19:47 -0700
  Re: JavaScript code security Myers <xdaamanx@gmail.com> - 2017-05-29 07:54 -0700
  Re: JavaScript code security Myers <xdaamanx@gmail.com> - 2017-05-29 07:55 -0700

csiph-web