top | item 44732379

(no title)

rbinv | 7 months ago

Yup, ASP's "__VIEWSTATE" hidden form parameter comes to mind. It was base64-encoded and POSTed because it could get loooong (hundreds of KB).

Terrible for browser navigation/refresh though, because pretty much everything was a form POST. Thus no URL state sharing, either.

discuss

bux93|7 months ago

Also a terrible idea to execute code from the client, even if it's supposedly signed.