Hacker News Reader

Comment by Lacerda69 | Hacker News Reader

Sorry the dumb question, but why not? Can't I make a static page that offers search (reload on every query with results) or profile (reload every time soemthing is changed in the profile)

View on HN

I think your understanding of "static" website is off.

A static site does not have any backend, thus cannot provide you with search results because it cannot do any computing at all (just provide you the same (static) content again and again).

Actually some subset of this functionality is possible with static or semi-static pages but actually the problem is not so much about a page being static or dynamic but about being read-only vs getting user input. As soon as you need to deal with user input, there are inherent security issues.

You can go around these by having some presets in the profile and providing cached results for the most common search types but this is more or less as far as you can go.

This is incorrect, any request made by a browser to a backend will by definition accept user input whether it wants to or not.

I can change the values of the presets I can add headers, remove headers change the value of cookies, add cookies, remove cookies etc etc.

Strictly speaking, you are correct. But in this case dealing with user input such as headers and their modifications is the responsibility of the server just like dealing with potentially malformed HTTP replies is the responsibility of the browser. What we are talking here though is the possibility of interaction with the remaining elements of the system (application, database). If these are read-only, the attacker loses these attack vectors.

Any reason it can't just have a JSON page somewhere, and then the search simply be a JavaScript app that looks through that static JSON for all the entries that contain a given token in it's list of keywords?

Most people don't need overly complex searches...

That would be so slow

Reply on news.ycombinator.com