Using ZnResponse>>#redirect: to pass an error message
Hello I catch an error like this: ``` [ self insertNewUser. ``` ``` ZnResponse redirect: self request url ] on: TbDbError do: [ :err | | ent | ``` ``` ZnResponse redirect: '/error/db_error' ] ]. ``` I would like to pass ``` err messageText ``` to the page at: â/error/db_errorâ, to display to the user. I prefer not to cache it is a session or use a Js hack to do it. Does someone have a strategy for passing objects via a ZnResponse instance? I did try ``` ZnResponse redirect: aUrl entity: anEntity ``` but the entity is discarded by the time it gets to the page. Vince
Hi To answer my own question, I passed the error message as a parameter in the url: ``` [ self insertNewUser. ``` ``` ZnResponse redirect: self request url ] on: TbDbError do: [ :err | | url | ``` ``` url := (ZnUrl fromString: 'error/db_error/') ``` ``` queryAt: 'msg' put: err messageText; ``` ``` yourself. ``` ``` ZnResponse redirect: url ] ``` Vince
Hi again Unfortunately the solution I came up with above is vulnerable to cross-site scripting attack (XSS). The solution takes the parameter passed in from the url and shows it to the user. An attacker can insert a script and send the link to a user for instance. Please do not do this. You can mitigate the XSS attack with CSP (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-P...), but it can be tricky to get right. Back to square one. Vince
participants (1)
-
vinref@gmail.com