Web Developer Security Checklist

Re:Web Developer Security Checklist by partycoder on Tuesday May 16, 2017 @05:55AM (#14348458)

But all the objects remain leaked even if the request connection ends. And if the request stream got piped into another stream the problem can become more severe.

Usually error events propagate through piped streams, but that largely depends on the order in which the event handlers were defined.

[ Parent | on HN ]

Re:Web Developer Security Checklist by aeronautic on Tuesday May 16, 2017 @06:01AM (#14348482)

Are you sure the objects remain leaked when a connection disconnect comes through? I don't have hard data on that.

Depending on the node web framework (express, ...) they may handle that differently and may have timeouts to cleanup.

I'd love to get a firm answer on this one.

[ Parent | on HN ]

Re:Web Developer Security Checklist by brlewis on Tuesday May 16, 2017 @08:14AM (#14348933)

I'd love a firm answer too, but I'm too lazy to write up code that puts request objects in a WeakSet and checks for when the set gets smaller. I hope someone else does it. :-)

[ Parent | on HN ]

Re:Web Developer Security Checklist by partycoder on Tuesday May 16, 2017 @01:30PM (#14351470)

Yes, I am certain of that. I've seen it in production environments and verified it by looking at heap dumps.

[ Parent | on HN ]