Timeline for Is there a security benefit to testing HTTP header presence with Javascript?
Current License: CC BY-SA 4.0
20 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 16, 2019 at 14:10 | vote | accept | Ilya Chernomordik | ||
| Oct 15, 2019 at 11:11 | answer | added | user163495 | timeline score: 1 | |
| Oct 14, 2019 at 23:55 | comment | added | Jeff Ferland♦ | Reopned with some edits. I think this is worthy of addressing whether an example like this is cargo culting without having to seek the explanation of the developers of the code in question. Feels similar in nature to security.stackexchange.com/questions/131106/… but worthy of its own discussion. | |
| Oct 14, 2019 at 23:51 | history | edited | Jeff Ferland♦ | CC BY-SA 4.0 |
deleted 455 characters in body; edited title
|
| Oct 14, 2019 at 23:50 | history | reopened |
user163495 Ilya Chernomordik Jeff Ferland♦ |
||
| Oct 14, 2019 at 13:10 | review | Reopen votes | |||
| Oct 14, 2019 at 23:55 | |||||
| Oct 14, 2019 at 12:51 | comment | added | user163495 | I also don't see how this question is opinion-based. In my opinion, asking the negative "Is the absence of these headers for an API a security risk?" is on-topic. | |
| Oct 14, 2019 at 12:36 | comment | added | Ilya Chernomordik | @schroeder if there are all too many possibilities I would like to hear about some at least as I fail to see how this code can improve security. Can't see how it is opinion based? There is either a known use case it can solve or there isnt? | |
| Oct 14, 2019 at 12:33 | comment | added | Ilya Chernomordik | The library queries data from another server (a json object) and then renders som GUI represenation of that object (let's say {firstname: "A", lastname: "B"} is a response and the library has a component that can be rendered nicely for that json structure) | |
| Oct 14, 2019 at 12:31 | comment | added | schroeder♦ | There are far too many possibilities for why one would want to do this. We do not know the API or what the library is for. | |
| Oct 14, 2019 at 12:30 | history | closed | schroeder♦ | Opinion-based | |
| Oct 14, 2019 at 12:29 | comment | added | Ilya Chernomordik | I know, I think the same, but noone can come up with a better idea of why apart from this document and noone knows who and why wrote it now :) Typical problem for large organization, but the fact is there is code and noone can explain why, that's why I am asking in here if maybe there is something I am missing | |
| Oct 14, 2019 at 12:29 | comment | added | schroeder♦ | "internal" as in, someone in your company? If so, then you need to ask the dev, not us. | |
| Oct 14, 2019 at 12:29 | history | edited | Ilya Chernomordik | CC BY-SA 4.0 |
added 38 characters in body
|
| Oct 14, 2019 at 12:27 | comment | added | user163495 | @IlyaChernomordik Sounds more like "cargo cult" to me. If you can ask the developer of the library what it should secure against, perhaps he could give an insight. I personally consider it pointless, as the target it not a browser. None of these headers mean anything by themselves. | |
| Oct 14, 2019 at 12:23 | comment | added | Ilya Chernomordik | Yes, I am sure, it's an internal library and there is a document that says that it's a security measure, failing to explain why... | |
| Oct 14, 2019 at 12:20 | history | edited | Ilya Chernomordik | CC BY-SA 4.0 |
added 66 characters in body
|
| Oct 14, 2019 at 12:19 | comment | added | schroeder♦ | "as a security measure" - are you sure it is a security measure? It seems like this would be a question for the library dev and not random people. | |
| Oct 14, 2019 at 12:19 | history | edited | Ilya Chernomordik | CC BY-SA 4.0 |
added 66 characters in body
|
| Oct 14, 2019 at 11:35 | history | asked | Ilya Chernomordik | CC BY-SA 4.0 |