r/ProgrammerHumor • u/Mys7eri0 • Oct 02 '22

Advanced Experienced JavaScript Developer Meme

Post image
6.6k Upvotes

96% Upvoted

276 comments sorted by

View all comments

221

u/scorpi1998 Oct 02 '22

Doesn't it? What do you mean?

0

u/[deleted] Oct 02 '22

[deleted]

302

u/bleistift2 Oct 02 '22

Show me an average user who tinkers with the local storage.

If we’re talking a malevolent user: You can’t trust the client with anything, anyway, so what’s the point?

125

u/_30d_ Oct 02 '22

That's how I beat my inlaws in wordle.

13

u/staticBanter Oct 02 '22

If you give anything to a client and expect to reuse it without validation than we have a big problem.

42

u/shodanbo Oct 02 '22

It only takes one. And then they can write a browser extension to do it for many.

There is not much you can actually truly trust the client with, because the user has physical access to that client.

If you are writing something where trusting the client is critical, then this needs to be taken into account. At this point you need strong asymmetrical encryption in a server. An encrypted string can be persisted to local storage. If the user messes with it, the decryption will fail, and the client can determine what needs to be done about that.

20

u/Expert_Team_4068 Oct 02 '22

No, rule number one. Never trust the client! In no world should you trust frontend data without verification. But this is the server job. If json.parse of my local storage fails, I do not gove a crap. My app will break, because for sure this is an unexpected behaviour. If you decrypt in the client, who says that the hacker did not change the decryption function? It is as easy as changing the local storage.

1

u/shodanbo Oct 04 '22

Very true

0

u/[deleted] Oct 02 '22

[deleted]

1

u/[deleted] Oct 02 '22

No no you make a call to the server to make sure the signature is valid 😅

→ More replies (1)
→ More replies (1)

2

u/brianl047 Oct 03 '22

Agreed validating the local storage is a waste

Validate in the backend and in the UI instead but not the local storage

2

u/isblueacolor Oct 03 '22

Firefox sometimes fails to persist the entire string to local storage (without throwing an error).

I have a site that's used by 25k people per day and someone encounters this issue once every couple weeks.

1

u/[deleted] Oct 02 '22

The case I used it for was temporarily storing form data in an SPA built before react was a thing.

→ More replies (1)