76
Self-documenting Code (lackofimagination.org)
you are viewing a single comment's thread
view the rest of the comments
[-] koper@feddit.nl 37 points 1 day ago* (last edited 1 day ago)

Why the password.trim()? Silently removing parts of the password can lead to dangerous bugs and tells me the developer didn't peoperly consider how to sanitize input.

I remember once my password for a particular organization had a space at the end. I could log in to all LDAP-connected applications, except for one that would insist my password was wrong. A trim() or similar was likely the culprit.

[-] spechter@lemmy.ml 29 points 1 day ago

Another favorite of mine is truncating the password to a certain length w/o informing the user.

[-] NotationalSymmetry@ani.social 15 points 1 day ago

Saving the password truncates but validation doesn't. So it just fails every time you try to log in with no explanation. The number of times I have seen this in a production website is too damn high.

[-] nitefox@sh.itjust.works 1 points 1 day ago

It also can truncate on the BE side when using the damn varchar

[-] nous@programming.dev 3 points 1 day ago

Passwords should be hashed, not stored plain text! Hashes are always the same length so this is an immediate sign they are doing horribly insecure things with your password.

[-] Flipper@feddit.org 9 points 1 day ago

The password needs to be 8 letters long and may only contain the alphabet. Also we don't tell you this requirement or tell you that setting the password went wrong. We just lock you out.

[-] HamsterRage@lemmy.ca 12 points 1 day ago

The reason for leaving in the password.trim() would be one of the few things that I would ever document with a comment.

[-] Aijan@programming.dev 15 points 1 day ago* (last edited 1 day ago)

Thanks for the tip. password.trim() can indeed be problematic. I just removed that line.

this post was submitted on 21 Oct 2024
76 points (85.2% liked)

Programming

17241 readers
263 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev



founded 1 year ago
MODERATORS