That’s why I wrote this post. I think many people don’t really care about security until they get caught. They assume that using the newest PHP version, running Tails OS, and connecting through a VPN automatically makes them safe.
Personally, I believe agencies like the CIA are at least ten years ahead of us in terms of capabilities.
the best way is to develop your custom framework but i dont think youll get it as secure as laravel.. there are no tricks its same as clearnet. if javascript is enabled not only you can get hacked but even your users. js will give them the ability to run scripts on user machines..
CSRF: it's like forcing the user to do unwanted action, example: triggering an action via example.com/send-money?quantity=1-Million , this is a CSRF if the user send 1 Million when he visit that link, it's also IDOR since a destructive action is set in the URL.
SSRF: it's forcing the website itself not the user.
An example of SSRF:
Imagine a website that lets users upload an image by URL:
example.com/upload?image_url=https://site.com/image.jpg
The server downloads the image from that URL.
An attacker changes the URL to something like:
http://localhost/admin
or
http://169.254.169.254/latest/meta-data/
Now the server requests internal resources instead of a public image.
And passwords should work like this:
You want to protect /admin/ with a password, put that password in a password manager, but for something like Session ID & CSRF Token or JWT token, put them in an .env file.
And it's good for the stack, you can make your website with PHP or NodeJS, you don't need to learn another framework/language, but if you want, pick Python, it have similar syntax to JavaScript but much simpler and more explicit.
SSRF: it's forcing the website itself not the user.
An example of SSRF:
Imagine a website that lets users upload an image by URL:
example.com/upload?image_url=https://site.com/image.jpg
The server downloads the image from that URL.
An attacker changes the URL to something like:
http://localhost/admin
or
http://169.254.169.254/latest/meta-data/
Now the server requests internal resources instead of a public image.
And passwords should work like this:
You want to protect /admin/ with a password, put that password in a password manager, but for something like Session ID & CSRF Token or JWT token, put them in an .env file.
And it's good for the stack, you can make your website with PHP or NodeJS, you don't need to learn another framework/language, but if you want, pick Python, it have similar syntax to JavaScript but much simpler and more explicit.
thank you so much for the time you put to make this message, i read it and save it
Enabling js on your website should not put you at risk. And if you are not malicious, it shouldn't put your users at risk either. It is just that your users can't trust you, so you shouldn't force js on them.
Members-only continuation
This discussion contains more posts.
Create an account or sign in to continue reading the full conversation. 16 additional posts await inside.