renderorange / pasteburn Goto Github PK

The current functionality of the routing and template doesn't allow the author to view the secret they just created. This is done by checking their cookie to see if the secret id is present. The route and template then see them as the author and doesn't present them the option to decrypt and view the secret.

Looking at the web server logs, there are a lot of people who create a secret but never decrypt it. I suspect they're just testing it out and don't see the option to view it, and maybe think it doesn't actually work.

Adding the option to decrypt a message you just created doesn't make a lot of sense to me, but I could see how someone unfamiliar with the codebase might think the application doesn't actually work. For that, adding the ability to view your own secret makes sense to add.

if administrators want to allow users to create a secret without a passphrase, there should be a configurable option to allow it.

it's not ideal to me from a design perspective, but since the application doesn't restrict complexity for passphrases, users can use simple single word passphrases, which aren't any more secure.

sqlite in this project is basically functioning as a key value store, which is what redis is by design. redis also supports setting expire time, which means removing the dep of a cronjob running to clear out the expired secrets.

Plack::Test to spinup the app, Test::WWW::Mechanize or similar to submit the form and check output.