HoboMan posted:

tps: i be all like "GET /" and the client app says "cant GET /" and i just have to sit here and imagine why i can't GET / because my browser's certainly not gonna tell me, and there's no precious logging to help me out either.

quote:

Who should read this article?

Everyone, really.

quote:

Who actually reads this article?

nobody lol

HoboMan posted:

tps: i be all like "GET /" and the client app says "cant GET /" and i just have to sit here and imagine why i can't GET / because my browser's certainly not gonna tell me, and there's no precious logging to help me out either.

ThePeavstenator posted:

I just had a pull request accepted to tinkerpop gremlin, it's my first open sores contribution.

It was literally 1 character but fixed a bug where the graph database client would run out of connections after a few hours.

florida lan posted:

https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

the


really should be followed by


it may well be some other reason but i am astounded by how many people who work with web apps have just somehow never heard of cors and have never looked at dev tools to see the big angry 'hey you should check out cors' warning that pops up when its constraints arent satisfied.

Sapozhnik posted:

Certain attacks were always possible through malicious IMG tags or post forms or combining the above with URLs that cause http to happen on non http ports.

New stuff that adds additional potential attack vectors beyond what already existed has to prove remote consent first. This happens through same origin policy or cors for, well, cross origin requests, or the websocket handshake to prevent arbitrary JavaScript from generating arbitrary TCP traffic to arbitrary hosts.

Why does a websocket handshake begin with something that looks like an http get? Because a malicious IMG tag could already generate those against arbitrary ports on arbitrary hosts long before even JavaScript was a thing.

pseudorandom posted:

And for off-site form/img things, I assume you'd need to have already compromised the target host if you want to access the auth/session tokens for performing requests that result in changes being made.

Jabor posted:

You do realise that the person who wrote a website might not be the same as the person accessing it through a web browser, right?

pseudorandom posted:

Yes? By "compromised" I was mostly referring to XSS and a malicious party gaining access to cookies/localStorage.

Chalks posted:

[something in webdev] is a garbage implementation of a good idea

Sagacity posted:

Chalks posted:

[something in webdev] is a garbage implementation of a [bad] idea

pokeyman posted:

I set up a simple pipelines thing a few months back and it took me about as long as it usually takes me to go from nothing to sorta working. I think there was some essential information in various forum posts and such, I don’t remember the documentation itself being super useful

Wheany posted:

yeah, i guess is need to set up a locak docker environment to explore the container and test the thing. which i didn't really even think about before rubberducking the thread

Wheany posted:

here is what i think i want to do:
i want to build a java 8 spring boot project using maven
i want to copy the resulting jar over scp onto our [dev, staging, production] server into the correct directory.

how do i docker this?

Shaggar posted:

just use maven for everything

Corla Plankun posted:

how can i add auth to a thing that already exists and is written by someone not-at-this-company?

i basically want to MITM an internal website that we're serving to add auth on top of it and i have no idea how to do this at all

i guess i could just fork the original and add auth to the actual site but i really dont want to do webdev if i can help it

HoboMan posted:

angular

CRIP EATIN BREAD posted:

found your problem

Aramoro posted:

Corla Plankun posted:

how can i add auth to a thing that already exists and is written by someone not-at-this-company?

i basically want to MITM an internal website that we're serving to add auth on top of it and i have no idea how to do this at all

i guess i could just fork the original and add auth to the actual site but i really dont want to do webdev if i can help it

Aramoro posted:

If you've managed to make your Angular compile fail silently you're problem starts before you get to the Angular part.

CRIP EATIN BREAD posted:

Is there zero auth on the site, as in, anyone who views the page is the same as every other person? Because if you just want to authenticate users against some directory, you can use nginx nginx as a proxy with the auth request module, https://nginx.org/en/docs/http/ngx_http_auth_request_module.html which allows you to set up a small REST endpoint that nginx will pass requests to and let you do it that way.

basically you will just set up some small server that is essentially:

code:

// mapped to GET /
fun testAuth(params): int {
  user = params["user"];
  passwd = params["passwd"];

  if (user == "yospos" && passwd == "bithc") {
    return 200;
  }

  return 401;
}

then tell nginx to hit that endpoint using the auth_request directive

Aramoro posted:

If you've managed to make your Angular compile fail silently you're problem starts before you get to the Angular part.

Shaggar posted:

yeah you decided to use a javascript

DONT THREAD ON ME posted:

i'm going to make the worlds first anti-capitalist terminal emulator and call it griTTY