Comments (4)
I guess there is a question of why Plug.BasicAuth was added and I guess at the moment I don't have a good answer for, besides the fact it is security related, so we likely want to have a established practice.
At the same time, there are plugs today in Plug that in theory wouldn't need to be in Plug (I guess Plug.MethodOverride as an example), but they were added because they were needed early on as part of Plug development. At the same time, they are very small. While CORS and Health are usually more configurable and therefore more LOCs.
from plug.
Hi @pdgonzalez872! My suggestion is to move this to the forum then, where more people can join. From my point of view, if there is a package for it, then the issue has been addressed. :) Similar to other essential features, such as CORS, templating, etc. which are all important and handled as part of the community.
from plug.
very fair! Thanks!
from plug.
@josevalim, I came across something that I believe is along the lines of "want to have established practices" -> CSP
Some folks eventually come across it after using Sobelow and I think it's not a topic folks either know much about (my case) or just don't discuss in the open that much. The docs in Sobelow's repo were added after a brief issue discussion in the issues back in 2020.
The best implementation of this I found in the wild was Bytepack's (thanks for making it open source ❤️):
- https://github.com/dashbitco/bytepack_archive/blob/79f8e62149d020f2afcc501592ed399f7ce7a60b/apps/bytepack_web/lib/bytepack_web/extensions/plug/csp_header.ex
- https://github.com/dashbitco/bytepack_archive/blob/79f8e62149d020f2afcc501592ed399f7ce7a60b/config/config.exs#L26-L35
- https://github.com/dashbitco/bytepack_archive/blob/79f8e62149d020f2afcc501592ed399f7ce7a60b/apps/bytepack_web/lib/bytepack_web/router.ex#L21-L22
GriffinMB mentioned this header is app specific in the original Sobelow issue. Even though I agree, it seems like there are great defaults/best practices in Bytepack implementation?
As you mentioned, it's great to have established best practices around security. I wanted to get your thoughts from your point of view. Is this a Plug like BasicAuth? Is this a blog post/ElixirForum post? Maybe some docs in the Phoenix
guides?
I'd be glad to try to help in any way I can. Thank you, as usual :)
from plug.
Related Issues (20)
- Mismatch spec for `Plug.Conn.Query.decode` HOT 1
- Plug.RequestId: put the `request_id` in `:private` or `:assigns`? HOT 1
- 1.15 changes decoding behaviour of `[]` HOT 5
- Request: Support MFA tuple for Plug.Session opts HOT 4
- Plug.Upload's random-tempdir generation is not very random HOT 1
- `strip_spaces` fails on `nil` since 1.15.0 HOT 1
- Plug.Conn.Query has changed the way it decodes parameters from 1.14 to 1.15 without warning HOT 1
- More flexible dynamic routes with `:` parameters HOT 2
- Compatibility issue with plug_crypto 2.0.0 HOT 3
- Error: There isn't enough space to open the popup HOT 1
- Docs inconsistency between Plug moduledoc and Plug.run HOT 1
- Plug.Upload: demonitor previous owner when giving away HOT 1
- Compilation issues on Erlang 26.x HOT 3
- html array items are dropped. HOT 1
- Plug.Conn is not closed when user closes the browser's tab (SSE) HOT 2
- setting max_age to nil in put_resp_cookie/4 causes crash HOT 1
- Sending a zip created on-the-fly via Plug.Conn.chunk fails after around 200Mb HOT 8
- Performance Regression in Plug.Conn.Cookies.decode/1 after Upgrading Elixir and Erlang HOT 3
- Plug.Router macros and functional plugs HOT 1
- Wrong editor links when running inside a container HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from plug.