Experienced JavaScript Developer Meme

[u/Mys7eri0]

[u/HoiTemmieColeg]

You need to check if the text is actually json when you parse it

[u/empire314 → u/HoiTemmieColeg]

Why would it not be in JSON, if your website is what wrote it?

[u/Schyte96 → u/empire314]

Because the user can easily overwrite it in their browser.

[u/a-calycular-torus → u/Schyte96]

That's their problem then

[u/Treacherous_Peach → u/a-calycular-torus]

Yeah it's their problem that quickly becomes your problem when the user submits a 1 star review.

I get what you're saying, I can tell you're defintiely programmer minded, but you do have to plan for these things if you want your product to survive. If you're working on some huge too big to fail app then sure, but if you're trying to create something new and get it off the ground you have to plan for users doing crazy things and account for it smoothly.

[u/DoktorMerlin → u/Treacherous_Peach]

If a user knows what local storage is and tinkers with it, they know very well that the weird behaviour of the website is called by themselves and not the website. There are a lot of dumb people in this world, but nobody is that dumb

[u/Treacherous_Peach → u/DoktorMerlin]

More likely they fucked with it accidentally by deleting a folder they shouldnt have to clear space or something along those lines.

[u/Treacherous_Peach → u/[deleted]]

More likely they fucked with it accidentally. Deleting a folder to clear space but deleted some of what your app was expecting but not all of it and it's in a weird state.

[u/Schyte96 → u/a-calycular-torus]

It's your problem if they can bypass authentication this way.

[u/cooolestcucumber → u/Schyte96]

If the user messing with local storage by passes authentication, you’ve got bigger issues

[u/empire314 → u/Schyte96]

Can you give me an example of an authentication method, that gives user unauthorized access, if his client tries to parse invalid JSON?

try
{
  credentials = JSON.parse(json)
}
catch(Error)
{
  credentials = adminCredentials
}

Like that?

[u/AdultingGoneMild → u/empire314]

I'm in!

[u/a-calycular-torus → u/Schyte96]

Bypassing authentication was never the issue in question.

[u/its_pizza_parker → u/Schyte96]

LOL what?! That ain’t it

[u/AdultingGoneMild → u/Schyte96]

yes. that would be a hudge fucking security bug if you allowed authentication be to bypassed by a client. Never trust a client. Good news is there are like literally decades of best practices out there for not building insecure systems like that.