417
Mo Validation Mo Problems (thelemmy.club)
submitted 8 months ago* (last edited 8 months ago) by to c/programmer_humor@programming.dev
68 comments fedilink hide all child comments
 

...

you are viewing a single comment's thread
view the rest of the comments
[–] 18 points 8 months ago* (last edited 8 months ago) (10 children)

and when the rule is also wrong example: password must contain special charcters

the password in question contained : and ^

if those aren't special characters idk what is

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 10 child comments
    •
  • [–] 13 points 8 months ago* (6 children)

    maybe they were looking for extra special characters like 🁄 or ⶸ. Who am I kidding, RFC 1738 tells us that literally everything is unsafe and you know, we need to prepare for the inevitable occasion when the password somehow ends up inside an URL.

    The characters "<" and ">" are unsafe because they are used as the delimiters around URLs in free text;
    the quote mark (""") is used to delimit URLs in some systems.
    The character "#" is unsafe
    The character "%" is unsafe

    It ends up with

    Thus, only alphanumerics, the special characters
    $ - _ . + ! * ' ( ) ,
    are safe

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 5 points 8 months ago (3 children)

    If the password is going in URLs you already have a problem.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 8 months ago (2 children)

    It's safe for https.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 8 months ago (1 child)

    In terms of the transport, sure.

    But if you put the password in a URL, the user's browser is going to turn around and store that plaintext password in its history, then sync it to the user's other devices, and then pop it up on their screen in the address bar autocomplete, perhaps when the user is screen sharing or streaming to hundreds of people. The browser does not expect a password to be stored there and will mishandle it.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •