Hacker News Reader

I mean, they got pwned because they didn't validate the state against the current user's session. Not because storing state in the URL is insecure.

View on HN

If you’re validating client url state against server session state that kind of defeats the purpose of trying to put all the state in the url.

You’re technically correct/sounds like you agree it’s still a bad idea, even if there’s a way to duplicate certain state for validation and make it work. Staying shackled to the earth via stupid rules of thumb like minimizing client state in banking apps does keep you from flying straight into the sun, though, which is nice.

How can you secure state stored in the URL?

You don't. You secure the resources the state accesses.

Reply on news.ycombinator.com