News for hackers. Stuff that matters.

A comment on File Uploading without a Server.

Re:File Uploading without a Server by emilv on Wednesday September 04, 2013 @04:19AM (#6326257)
No, there is no use case where this is feasible on the public web. Even a small site with a strange URL and few visitors will be attacked in exactly the way described in the blog post if they try to use this. I'm sure some bot maintainers are already pushing for a detection of this enormous security hole.

Do not do this.

[ Parent | on HN ]
Re:File Uploading without a Server by NKCSS on Wednesday September 04, 2013 @04:53AM (#6326358)
There's lot of possibilities there; the demo page returns a tmp url that will work for a while with the data transfered, so you could use the service to distribute files in parts of 30MB max...
[ Parent | on HN ]
Re:File Uploading without a Server by emilv on Wednesday September 04, 2013 @04:54AM (#6326367)
Yes, anyone can use your site to host any file on your server.
[ Parent | on HN ]
Re:File Uploading without a Server by spolu on Wednesday September 04, 2013 @04:30AM (#6326295)
It's still interesting to explore the concept and think about how its always easier to build stuff exclusively client-side.
[ Parent | on HN ]
Re:File Uploading without a Server by emilv on Wednesday September 04, 2013 @04:59AM (#6326390)
I think that's a flawed assertion. It's easy to make an insecure file upload in most server-side web languages. An example in the PHP manual is only a couple of lines of code: http://www.php.net/manual/en/features.file-upload.post-metho...

How easy is it to make a safe client-side solution?

[ Parent | on HN ]