It's the handler that responds to the "Continue" form post on ... • Aaron Parecki

86°F

Torsten Lodderstedt https://twitter.com/tlodderstedt • May 31
But it’s exposed to the client and did accept arbitrary values, right?

It's the handler that responds to the "Continue" form post on this screen. Instead of a Boolean, the client sent back the actual email address and the server accepted arbitrary values.

Portland, Oregon • 54°F

Sun, May 31, 2020 5:42am -07:00

1 reply
Have you written a response to this? Let me know the URL:
- Aaron Parecki aaronparecki.com
  
  Now that I'm writing this out, I realize that the client also sends back the "name" here, intentionally, since the name is user-editable. So I can see how this happened. It's just extremely poor coding practice to essentially also allow the email to be editable here.
  
  Sun, May 31, 2020 5:45am -07:00

Posted in /replies using quill.p3k.io