Work in progress: 181,232 of 181,233 sites checked so far, more every week · updated 2 Nov 2026Missing a blog? Tell us

Top all-time · #6121

F

François Zaninotto

Personal blog · redotheweb.comwebprogramming

François Zaninotto's personal blog at redotheweb.com covers web and programming. Since 2008, 13 different Hacker News readers have linked it 24 times, most often “Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF”. The last post was in 2017, but the archive is still widely read.

Visit the blog
24mentions?
13HN people?
2008–2024first – last linked?
Links on Hacker News per year · peak 8 in 2013

Too few sampled comments (1) to say how often HN recommends it.?

Why HN links it

HN readers link this blog for posts on web storage and session tokens. The one comment, on localStorage versus HttpOnly cookies, weighs CSRF and XSS trade-offs and does not judge the post itself.

Summarised by Claude from a sample of 1 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.

Most-linked posts?

  1. Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF
    4 people · 5 mentions · first linked 2015-11-12
  2. Client-side full text search in CSS
    2 people · 2 mentions · first linked 2013-05-15
  3. “I Hate JavaScript”
    2 people · 2 mentions · first linked 2015-12-04

What Hacker News says?

  1. Sure. My reasoning: The localStorage token helps protect against CSRF, e.g., this token will not be submitted via a form embedded on another site (cookie will), therefore request will not be authenticated. In an XSS attack (aka "we're screwed"), the secure, HTTPOnly cookie at least adds an additional level of complexity above simply reading a single plaintext localStorage item. Perhaps this is naive? Of course I als…

    Comment linking /2015/11/09/api-security.html

    on “Web Storage: the lesser evil for session tokens”
  2. Submitted Client-side full text search in CSS as a story · 213 points

    HN discussion
  3. Hi! I'm one of the authors of Gremlins.js. Glad to see that some of you find it interesting. I wrote a blog post a while ago about the purpose of the lib, it's called "Completing the JavaScript Test Stack". Worth reading if you wonder what this is all about. http://redotheweb.com/2014/01/07/completing-the-js-test-stac...

    Comment linking /2014/01/07/completing-the-js-test-stack-introducing-greminsjs.html

    on “Gremlin.js: Throw a thousand monkeys at your page”
  4. Submitted You Should Write Ugly Code as a story · 20 points

    HN discussion
  5. Submitted CodeFlower Source Code Visualization as a story · 4 points

    HN discussion
  6. Submitted Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF as a story · 4 points

    HN discussion
  7. Submitted “I Hate JavaScript” as a story · 4 points

    HN discussion
  8. Submitted CodeFlower Source code visualization as a story · 4 points

    HN discussion
  9. Submitted Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF (2015) as a story · 3 points

    HN discussion
  10. Submitted “I Hate JavaScript” as a story · 3 points

    HN discussion
  11. Submitted Client-side full-text search in CSS as a story · 3 points

    HN discussion
  12. Submitted Visual Patterns in Source Code Arrangement as a story · 3 points

    HN discussion
  13. Submitted Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF (2015) as a story · 2 points

    HN discussion
  14. Submitted CodeFlower Source code visualization as a story · 2 points

    HN discussion
  15. Submitted What If API Status Pages Were Standardized? as a story · 2 points

    HN discussion
  16. Submitted Choose Collective Code Ownership as a story · 2 points

    HN discussion
  17. Submitted Should You Commit Your Dependencies? as a story · 2 points

    HN discussion
  18. Submitted Client-side full-text search in CSS (2013) as a story · 1 points

    HN discussion
  19. Submitted Your API-Centric Web App Is Probably Not Safe Against XSS and CSRF as a story · 1 points

    HN discussion
  20. Submitted Completing the JS Test Stack: Gremlins.js, a Monkey Test Library For Webapps as a story · 1 points

    HN discussion
  21. Submitted From Objects To Functions: Service Closures as a story · 1 points

    HN discussion
  22. Submitted DependencyWheel: An Interactive Visualization Of Package Dependencies as a story · 1 points

    HN discussion
  23. Submitted Agile development: How to prioritize a backlog? as a story · 1 points

    HN discussion
  24. Submitted Designing a CMS Architecture as a story · 1 points

    HN discussion

Search all of HN for redotheweb.com

Linked by the same people?