Hacker News Reader

I saw a $12 million app have to be essentially rewritten (at a bank)

The “genius dev lead who went to Princeton” kept pushing that they went to Princeton so people stopped arguing against it

Tried to do this securely and got pwned in the very first demo

View on HN

I mean, they got pwned because they didn't validate the state against the current user's session. Not because storing state in the URL is insecure.

If you’re validating client url state against server session state that kind of defeats the purpose of trying to put all the state in the url.

You’re technically correct/sounds like you agree it’s still a bad idea, even if there’s a way to duplicate certain state for validation and make it work. Staying shackled to the earth via stupid rules of thumb like minimizing client state in banking apps does keep you from flying straight into the sun, though, which is nice.

How can you secure state stored in the URL?

You don't. You secure the resources the state accesses.

Reply on news.ycombinator.com