Re:Why I believe Rails is still relevant in 2019
by klodolph on Tuesday March 19, 2019 @01:40PM
(#19433268)
CRSF is not an issue for JSON API endpoints, since cross-origin requests are disabled by default.
XSS in my experience is best solved by a reasonable templating language. The same way you don't use string concatenation to insert user data into HTML documents, you don't use string concatenation to insert user data into SQL queries. Frameworks don't add anything here that you don't already have, and a lot of frameworks let you choose your templating system anyway.
This was a big reason to use frameworks in past days, though.
XSS in my experience is best solved by a reasonable templating language. The same way you don't use string concatenation to insert user data into HTML documents, you don't use string concatenation to insert user data into SQL queries. Frameworks don't add anything here that you don't already have, and a lot of frameworks let you choose your templating system anyway.
This was a big reason to use frameworks in past days, though.