|
 |
|
|
Security-by-Default
H2O programs are not accessible until they are allowed in the H2O Control Panel. Other pages cannot be accessed unless they are called out in documents. Variables may not be passed into H2O until they are allowed or defined in an HTML form. Other security measures include:
- No reliance on Cookies.
- No exposure of server-side variables in dynamic links.
- No HTML or Javascript submitted in HTML forms unless allowed.
- No HREF links submitted in HTML forms unless allowed.
- No error reports include H2O code unless allowed.
- No ability to read/write outside H2O sandbox, unless allowed.
H2O security measures make it one of the most secure environments on the web. |
|