Hacker News new | ask | show | jobs
by Cyberdelic 3166 days ago
Not trusting user input is a good start, but the client shouldn't be trusted, either.

I have seen plenty of web apps that fell short on this...

Whenever I'm on a web app that has a button shown but disabled, you can be pretty sure that I will enable that button and click it...

If the client is limiting the maximum length of the contents of a textbox, I'm probably going to change that and see if the server is performing the same validation...

My favorite so far, though, was client-side calculation and validation of order amounts for some products. Intercepting the JavaScript file and tweaking it before the browser started using it allowed me to place an older for a bunch of products for only $0.01 (going negative was also attempted, too, but this particular system did a pre-approval with a payment gateway and it didn't like that... so I settled on a penny).

These were all things I've done with permission, of course... but it's amazing what you can do when people assume the browser will always follow the rules...
3 comments
artursapek 3166 days ago
At my last job the HR guy installed this super annoying Slack bot that would spam everyone every week with a "happiness survey". I got so tired of it I eventually logged the requests my survey made and used curl to replay one with a happiness score of -100 (usually the value would be between 0 and 10). Response said "success".

Turned out the backend happily took that value and it skewed our average a lot and the next week I was laughing my ass off while HR was trying to figure out why everyone was suddenly so unhappy.

link
AlexCoventry 3166 days ago
> Not trusting user input is a good start, but the client shouldn't be trusted, either.

That's in there:

"Validation must occur on the receiving side of communications. Validation on the sending side is a user experience decision."

link
eterm 3166 days ago
I would consider "user input" to be everything coming back from the client, that includes everything down to cookies, HTTP-Headers, form values.

Validate everything. Re-check authorisation always.

My favourite too was being new into a development job and buying our biggest package for a penny. What I hadn't counted on was that this was a fairly new system and the CEO was still copied in to every buy order.

Thankfully the company took it in good spirit, I was even sent an expenses form to reclaim the penny! :)

link