Comment on Multiple security vulnerabilities in RailsparentComments−ryanlol10yI've seen a bunch of companies use rails HTTP basic auth internally.And it's not that it wasn't caught until now, it's that it wasn't caught before the commit was accepted.−eropple10yI expect (though I have not looked) that it's old code that wasn't eyeballed for security so much as for consistency and correctness. Once in, it doesn't leave.
Comments
I've seen a bunch of companies use rails HTTP basic auth internally.
And it's not that it wasn't caught until now, it's that it wasn't caught before the commit was accepted.
I expect (though I have not looked) that it's old code that wasn't eyeballed for security so much as for consistency and correctness. Once in, it doesn't leave.