News for hackers. Stuff that matters.

A comment on Secure database-driven applications on Neocities. Parent comment

Re:Secure database-driven applications on Neocities by le-mark on Thursday July 06, 2017 @03:24PM (#14713129)
How is this different than someone attacking a contact form on a wordpress site? In your mind what would be a sufficient mitigation for a service like this? A one time use token for example? Captcha on the signup form?
[ Parent | on HN ]
Re:Secure database-driven applications on Neocities by jitl on Thursday July 06, 2017 @03:44PM (#14713275)
Yeah, I think your suggested mitigations sound reasonable. Everything in this space is going to be only partial mitigations, but it should still be discussed, especially if "secure" is a selling point and given that the FaunaDB service is billed based on usage.

What I would do:

- one-time use token for the creation form, a la CSRF tokens and nonces; Although that just doubles the number of requests needed to perform a submission

- rate-limit all endpoints based on IP, user agent, etc

- Captcha on creation form

[ Parent | on HN ]