RE: HTTP Server's jobs for CGI applications

[boldt@xxxxxxxxxx]

Leslie wrote:
>I don't get your point Hans, what you are talking about is
>sloppy programming not security holes.

OK, there are two separate issues in this current thread:
1) cookies and associated privacy issues; 2) JavaScript
and associated security threats (which I didn't go into
detail into)

In either case, we're not talking about "sloppy programming".
We're talking about specific intent either to collect
personal information or to compromise client system security.

Yes, you can certainly code JavaScript to detect specific
browsers, but that can be overridden by disabling JavaScript.

You could also detect on the server side which browser is
requesting the resource. But then the HTTP variables involved
can be faked or suppressed, so that's not a reliable
technique either.

My point is that it is only proper HTML coding style to not
have any dependencies on JavaScript for people to use your
web site.

Cheers!  Hans

Hans Boldt, ILE RPG Development, IBM Toronto Lab, boldt@ca.ibm.com


+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---