:-) put me on the spot! thanks for going through the code though.
security layer definitely needs more work. my choices were mostly limited by my haste to get a working prototype and not very well thought through.
security layer definitely needs more work. my choices were mostly limited by my haste to get a working prototype and not very well thought through.
Your fundamentals are fine, i don't think those are very serious problems compared to the average custom web app in the wild (most of which probably use plaintext passwords with no concern for sqli or xss...)
If not, I think there is potential for a timing attack here?
if usr == _admin_usr && pw == _admin_pw { return RootMode, nil }