Re:Why I believe Rails is still relevant in 2019
by klodolph on Tuesday March 19, 2019 @01:40PM
(#19433268)
CRSF is not an issue for JSON API endpoints, since cross-origin requests are disabled by default.
XSS in my experience is best solved by a reasonable templating language. The same way you don't use string concatenation to insert user data into HTML documents, you don't use string concatenation to insert user data into SQL queries. Frameworks don't add anything here that you don't already have, and a lot of frameworks let you choose your templating system anyway.
This was a big reason to use frameworks in past days, though.
Re:Why I believe Rails is still relevant in 2019
by sheeshkebab on Tuesday March 19, 2019 @07:28AM
(#19429800)
Most modern apps use api/json based endpoints where csrf is not needed (cookies are no longer used for auth) and xss is massively simplified since html is rarely returned by backend.
In other words most web frameworks that help with rendering html on the server and writing forms to database are not needed either.
right there... if I could vote you up a thousand times, I would. I can place a bet that most home grown apps have no security measures against CSRF or XSS in place.