Yup, ASP's "__VIEWSTATE" hidden form parameter comes to mind. It was base64-enco... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

		rbinv 5 months ago \| parent \| context \| favorite \| on: URL-Driven State in HTMX Yup, ASP's "__VIEWSTATE" hidden form parameter comes to mind. It was base64-encoded and POSTed because it could get loooong (hundreds of KB). Terrible for browser navigation/refresh though, because pretty much everything was a form POST. Thus no URL state sharing, either.

bux93 5 months ago [–]

Also a terrible idea to execute code from the client, even if it's supposedly signed.

https://darkatlas.io/blog/critical-sharepoint-vulnerability-...

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact