> The old app that I wrote would happily take JavaScript or SQL snippets as inputs to any text field and do The Right Thing.
Confused here. Where were input validation checks in your implementation? How did you guard against SQL injection, etc?
Confused here. Where were input validation checks in your implementation? How did you guard against SQL injection, etc?
And if you're using, for example, Go's templating library, then it automatically escapes everything in HTML templates unless you explicitly override this default behaviour.
The JS wouldn't need to do any escaping, because it's not trusted to handle any unescaped data. It's operating on the already-escaped html template.
There is a lot information, which is understandable but also conveniently supports a very unflattering narrative while simultaneously promoting the OP's awesomeness.
Q: "how do they use the workarounds needed to secure the more complex approaches?"
A: "those security concerns don't exist in the approach, no workaround needed. That's part of the simplicity".
It just represents a fundamental misunderstanding, but it's not their fault, they've never seen anything else. Like someone using a JWT instead of a session cookie.
Those aren’t mutually exclusive, you know.