Top all-time · #6121
François Zaninotto
Personal blog · redotheweb.comwebprogramming
François Zaninotto's personal blog at redotheweb.com covers web and programming. Since 2008, 13 different Hacker News readers have linked it 24 times, most often “Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF”. The last post was in 2017, but the archive is still widely read.
Too few sampled comments (1) to say how often HN recommends it.?
Why HN links it
HN readers link this blog for posts on web storage and session tokens. The one comment, on localStorage versus HttpOnly cookies, weighs CSRF and XSS trade-offs and does not judge the post itself.
Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF4 people · 5 mentions · first linked 2015-11-12
- Client-side full text search in CSS2 people · 2 mentions · first linked 2013-05-15
- “I Hate JavaScript”2 people · 2 mentions · first linked 2015-12-04
What Hacker News says?
Sure. My reasoning: The localStorage token helps protect against CSRF, e.g., this token will not be submitted via a form embedded on another site (cookie will), therefore request will not be authenticated. In an XSS attack (aka "we're screwed"), the secure, HTTPOnly cookie at least adds an additional level of complexity above simply reading a single plaintext localStorage item. Perhaps this is naive? Of course I als…
Comment linking /2015/11/09/api-security.html
on “Web Storage: the lesser evil for session tokens”Submitted Client-side full text search in CSS as a story · 213 points
HN discussionHi! I'm one of the authors of Gremlins.js. Glad to see that some of you find it interesting. I wrote a blog post a while ago about the purpose of the lib, it's called "Completing the JavaScript Test Stack". Worth reading if you wonder what this is all about. http://redotheweb.com/2014/01/07/completing-the-js-test-stac...
Comment linking /2014/01/07/completing-the-js-test-stack-introducing-greminsjs.html
on “Gremlin.js: Throw a thousand monkeys at your page”Submitted You Should Write Ugly Code as a story · 20 points
HN discussionSubmitted CodeFlower Source Code Visualization as a story · 4 points
HN discussionSubmitted Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF as a story · 4 points
HN discussionSubmitted “I Hate JavaScript” as a story · 4 points
HN discussionSubmitted CodeFlower Source code visualization as a story · 4 points
HN discussionSubmitted Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF (2015) as a story · 3 points
HN discussionSubmitted “I Hate JavaScript” as a story · 3 points
HN discussionSubmitted Client-side full-text search in CSS as a story · 3 points
HN discussionSubmitted Visual Patterns in Source Code Arrangement as a story · 3 points
HN discussionSubmitted Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF (2015) as a story · 2 points
HN discussionSubmitted CodeFlower Source code visualization as a story · 2 points
HN discussionSubmitted What If API Status Pages Were Standardized? as a story · 2 points
HN discussionSubmitted Choose Collective Code Ownership as a story · 2 points
HN discussionSubmitted Should You Commit Your Dependencies? as a story · 2 points
HN discussionSubmitted Client-side full-text search in CSS (2013) as a story · 1 points
HN discussionSubmitted Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF as a story · 1 points
HN discussionSubmitted Completing the JS Test Stack: Gremlins.js, a Monkey Test Library For Webapps as a story · 1 points
HN discussionSubmitted From Objects To Functions: Service Closures as a story · 1 points
HN discussionSubmitted DependencyWheel: An Interactive Visualization Of Package Dependencies as a story · 1 points
HN discussionSubmitted Agile development: How to prioritize a backlog? as a story · 1 points
HN discussionSubmitted Designing a CMS Architecture as a story · 1 points
HN discussion