Frühere Suchanfragen

Keine früheren Suchanfragen

Suchoptionen

Nur verfügbar, wenn angemeldet.
sueden.social ist einer von vielen unabhängigen Mastodon-Servern, mit dem du dich im Fediverse beteiligen kannst.
Eine Community für alle, die sich dem Süden hingezogen fühlen. Wir können alles außer Hochdeutsch.

Verwaltet von:

Serverstatistik:

1,8 Tsd.
aktive Profile

sueden.social: ÜberStatusProfilverzeichnisDatenschutzerklärung

Mastodon: ÜberApp herunterladenTastenkombinationenQuellcode anzeigenv4.4.3

#nodejs

7 Beiträge7 Beteiligte0 Beiträge heute
*
ReynardSec

A grumpy ItSec guy walks through the office when he overhears an exchange of words.

dev0: Big news - we finally upgraded every framework to the latest.
dev1: And the pipeline looks good: SAST, container scan, DAST... all green.
dev0: ItSec won't have anything to nitpick now!

ItSec (walking by): ... and BAC?
dev0: BAC?
ItSec: Broken Access Control [1]. Did you actually test for it?

dev1: What's he on about this time?

Let's learn by example: imagine an endpoint that returns a specific invoice.

GET /api/invoices/123
Authorization: Bearer <token-for-user-A>

User A legitimately fetches invoice 123. Now change only the ID:

GET /api/invoices/124
Authorization: Bearer <token-for-user-A>

If the app returns 200 with User B's data, you've got Broken Access Control (aka IDOR).

Even worse, try a write operation:

PATCH /api/invoices/124
Authorization: Bearer <token-for-user-A>

{"status": "paid"}

If that works... it's a problem.

Access control enforces who can do what on which resource. When it's broken, attackers can act outside their permissions: read others data, modify or delete it, or trigger business functions they shouldn't. In practice, this often comes from missing server-side checks that tie the caller to the resource owner (or an allowed role).

Why your shiny scanners may have missed it:

1) SAST sees code patterns, not ownership semantics (it can't deduce "invoice 124 belongs to User B").
2) DAST usually crawls with one session; it rarely performs cross-identity trials (User A poking at User B's data).
3) CI/CD "green checks" mean dependencies, images, and common vulns look fine - not that your authorization logic is correct.

What can you do?

1) Enforce checks on the server (never rely on the client): before every read/update/delete, verify the caller is the owner or has a permitted role.
2) Centralize authorization in a service/middleware.
3) Prefer opaque, unguessable IDs (UUIDs) over sequential integers, but still enforce server checks (UUIDs are not security).
4) Deny by default. Make allow-lists explicit.

[1] owasp.org/Top10/A01_2021-Broke

#webdev#cybersecurity#programming
Fortgeführter Thread
Aral Balkan

Bloody hell, finally, I think I’m done with the Markdown support rewrite in Kitten.

The Markdown rule for interpreting four spaces as code fences has been the biggest pain in my neck during this whole ordeal but, bitching aside, it means the parser is now more accurate and thus stronger for it.

If all goes well, expect a Monday release :)

kitten.small-web.org

:kitten:💕

kitten.small-web.orgKitten: Home
#Kitten#SmallWeb#SmallTech
Jan :rust: :ferris:

If you want to get off #GitHub and want to export your data (like repos, followers, stars), I've written a #CLI tool (7 years ago!) that should help with that:

export-my-github:

github.com/janriemer/export-my

⚠️ Warning: The tool _hasn't seen an update in 7 years_, so it might be broken. If you experience issues, please report them and I'll try to fix them.

Export your data from Github - easy as cake! 🍰. Contribute to janriemer/export-my-github development by creating an account on GitHub.
GitHubGitHub - janriemer/export-my-github: Export your data from Github - easy as cake! 🍰Export your data from Github - easy as cake! 🍰. Contribute to janriemer/export-my-github development by creating an account on GitHub.
#EMG#GetOffGithub#NodeJS
Aral Balkan

The new integrated Markdown parser I’ve been implementing in Kitten has been kicking my ass for the past few weeks but I think I finally have it fully working and seamlessly so. Expect a new release this/next week that brings the parsing of Markdown pages (.page.md files) in your apps up to the standard of the recently-improved runtime Markdown parsing in Kitten HTML tagged-template strings (within `<markdown>…</markdown>` blocks).

The coolest thing is I was able to implement this without introducing any new syntax. In fact, I was able to simplify things so that you can now add arbitrary JavaScript to your Markdown pages within a multi-line script block in the YAML front matter (`script: |`) and use JavaScript string interpolation syntax in your Markdown (and, of course, Kitten components and conditionals, which, themselves, rely on string interpolation).

The only place where you have to deviate from standard Markdown in your Markdown pages is if you have JavaScript string interpolations or Kitten components/conditionals in code fences within your Markdown. In that case, you’ll have to escape them (e.g., `<\${Component} />`, `\<if \${something}>something\</if>`, etc.). And, to be fair, the person most impacted by this is likely me as the Kitten documentation at kitten.small-web.org is written in Kitten so I had a lot of escaping to do. But for any other use case, it means that things should just work and work exactly as they do in JavaScript pages (page.js files).

Anyway, so this is going to be a breaking change so I thought I’d give you (the three of you playing with Kitten right now?) a heads up. Of course, I’ll be updating the documentation to reflect all this.

(Remember, Kitten is in pre-release and it’s the framework I’m building/using to create Catalyst – the Small Web hosting solution – and Yarn – a small web – peer to peer – personal site app. So Kitten isn’t the means, not the end. And, at least until the Version 1 API freeze, things can and will break. That said, there’s nothing stopping you from playing with it now and, to be fair, at this point, such breaking changes should become rarer and rarer).

:kitten:💕

kitten.small-web.orgKitten: Home
#Kitten#SmallWeb#SmallTech
Fortgeführter Thread
*
Aral Balkan

Ah, and also, forgot to mention this change:

Improved:

• Debugging your Kitten app is now easier when you run it using `INSPECT=true kitten …` as the Node runtime is launched using the `--inspect-brk` tag instead of the `--inspect` tag. This means that execution will wait for your debugger (e.g., Chromium’s DevTools at `chrome://inspect`, etc.) to connect before starting the server. This makes it possible to hit breakpoints that might previously have been impossible to reach as they occured before you had a chance to run the debugger.

Full change log:
codeberg.org/kitten/app/src/br

Zusammenfassungskarte des Repositorys kitten/app
Codeberg.orgapp/CHANGELOG.md an mainapp - A web development kit that’s small, purrs, and loves you.
#Kitten#SmallWeb#SmallTech
📡 MSNGC ~ Moist Shekel News - Goy Central | GNN ~ [ Goy Noticer Network ] 📡

I'm making great progress on my geopolitical/military interactive map inspired by Military Summary and other war mappers. Was able to figure out I need Node.js to be able to accomplish what I wanted to accomplish so far. Colored polygons and lines are functional. I just need to add other features and make sure they work now. #Warmapping #mappping #geopolitics #interactivemaps #nodejs #maps

pleroma.postawakening.comThe Post-Awakening News Network
*
Mark Gardner

TIL that software (especially #scripting runtimes like #Python, #Perl, and #NodeJS) running in #Alpine #Linux containers is often slower than in other distros like #Ubuntu. This is despite Alpine being faster on startup and often vastly more efficient with CPU, memory, and storage.

It mostly comes down to Alpine’s use of musl libc rather than #GNU’s glibc. musl is optimized for minimalism, not raw performance. Also, the Alpine packages are often not compiled with as many optimizations.

Paul Welty

New blog post: I rebuilt my dashboards to use server-side data fetching via Python

Instead of hitting the DB from the browser, I pre-fetch data on the server and serve static HTML/JS.
🚀 Super fast
🔒 Cleaner security
🤖 Ready for AI workflows

This architectural shift simplified everything—no front-end framework, no runtime overhead. Worth trying if you’re client-side-JS-fatigued.

🔗 paulwelty.com/server-side-dash

www.paulwelty.comServer-Side Dashboard Architecture: Why Moving Data Fetching Off the Browser Changes Everything - Polymathic
#WebArchitecture#Dashboards#Nodejs
mastodon.raddemo.host

🚀 How to Install and Run Rocket.Chat on #Debian #VPS This article describes how to install and run Rocket.Chat on Debian VPS.
What is Rocket.Chat?
Rocket.Chat is an open-source communication platform designed for team collaboration and messaging, similar to Slack or Microsoft Teams. It offers a flexible, self-hosted alternative for businesses, communities, and developers who want full control ...
Continued 👉 blog.radwebhosting.com/install #selfhosting #rocketchat #nginx #nodejs #selfhosted #certbot

RadWeb, LLC · 🚀 How To Install And Run Rocket.Chat On Debian VPS - VPS Hosting Blog | Dedicated Servers | Reseller HostingThis article describes how to install and run Rocket.Chat on Debian VPS.
AngesagtLive-Feeds
Über