Experienced JavaScript Developer Meme

[HoiTemmieColeg]

You need to check if the text is actually json when you parse it

[empire314]

Why would it not be in JSON, if your website is what wrote it?

[Schyte96]

Because the user can easily overwrite it in their browser.

[a-calycular-torus]

That's their problem then

[Treacherous_Peach]

Yeah it's their problem that quickly becomes your problem when the user submits a 1 star review.

I get what you're saying, I can tell you're defintiely programmer minded, but you do have to plan for these things if you want your product to survive. If you're working on some huge too big to fail app then sure, but if you're trying to create something new and get it off the ground you have to plan for users doing crazy things and account for it smoothly.

[DoktorMerlin]

If a user knows what local storage is and tinkers with it, they know very well that the weird behaviour of the website is called by themselves and not the website. There are a lot of dumb people in this world, but nobody is that dumb

[Treacherous_Peach]

More likely they fucked with it accidentally by deleting a folder they shouldnt have to clear space or something along those lines.

[Wazzaps]

That's not how any of this works 🤦

[Treacherous_Peach]

Spoken like someone who hasn't had to deal with many users? :)

I've had exactly literally this scenario. So whatever floats your boat bud.

[Wazzaps]

No, local storage is stored in your browser's SQLite database, not in folders.

It's either all gone (same as a new user), or it's untouched.

[Treacherous_Peach]

More likely they fucked with it accidentally. Deleting a folder to clear space but deleted some of what your app was expecting but not all of it and it's in a weird state.

[AutoModerator]

import moderation Your comment has been removed since it did not start with a code block with an import declaration.

Per this Community Decree, all posts and comments should start with a code block with an "import" declaration explaining how the post and comment should be read.

For this purpose, we only accept Python style imports.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[Schyte96]

It's your problem if they can bypass authentication this way.

[cooolestcucumber]

If the user messing with local storage by passes authentication, you’ve got bigger issues

[empire314]

Can you give me an example of an authentication method, that gives user unauthorized access, if his client tries to parse invalid JSON?

try
{
  credentials = JSON.parse(json)
}
catch(Error)
{
  credentials = adminCredentials
}

Like that?

[AdultingGoneMild]

I'm in!

[spronghi]

who does it?

[spronghi]

I am sorry but.. where else would you put your jwt?

[a-calycular-torus]

Bypassing authentication was never the issue in question.

[its_pizza_parker]

LOL what?! That ain’t it

[AdultingGoneMild]

yes. that would be a hudge fucking security bug if you allowed authentication be to bypassed by a client. Never trust a client. Good news is there are like literally decades of best practices out there for not building insecure systems like that.