blocks|key|5900379|text|这是过度依赖客户端编程而没有服务器端呈现作为后备的副作用。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5900380|它与安全没有任何关系。|5900381|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

It is a side-effect of an overreliance of client-side programming without server-side rendering as a fallback.
It has nothing to do with security whatsoever.

blocks|key|4432305|text|在web的早期，所有内容都出现在HTML代码中。这些页面几乎没有动态。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4432306|在历史上，页面变得越来越动态，有了更多的JavaScript。一些文档元素是通过JavaScript创建的，以响应一些用户事件(比如向表中添加行)。这成为了一种模式，这种模式也延伸到了页面的初始构建:一些流行的库完全是围绕着这个想法构建的。在极端情况下，HTML只包含一个script标记(除了html和body元素之外)，JavaScript根据其他一些配置(在数据库、配置文件、JSON等中)完成生成页面的全部工作。它取消了超文本标记语言的设计，并将这一责任转移给了JavaScript。|offset|length|style|CODE|4432307|这不是一个安全问题。这只是一些框架工作的一种方式。|4432308|entityMap^0|0|3S|6|43|4|48|4|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|M|8|@$D|N|E|O|F|G]|$D|P|E|Q|F|G]|$D|R|E|S|F|G]]|9|@]|A|$]]|$1|H|3|I|5|6|7|T|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|U|8|@]|9|@]|A|$]]]|K|$]]

In the early days of the web, all was present in the HTML code. There was little dynamic on those pages.
Through history the pages became more and more dynamic, with more JavaScript. Some document elements were created through JavaScript, in response to some user events (like adding rows to a table). This became a pattern that extended also to the initial build up of the page: some popular libraries are completely built around that idea. In the extreme, the HTML only contains one <code>script</code> tag (besides the <code>html</code> and <code>body</code> elements), and the JavaScript does the whole job of generating the page, based on some other configuration (in a database, configuration files, JSON, ...). It takes away the HTML design, and moves this responsibility to JavaScript.
This is not a security concern. Just one of the ways some frameworks work.

blocks|key|2115483|text|浏览器的页面源代码仅显示在服务器上呈现的内容。我们称之为服务器端渲染。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|2115484|如今，随着客户端呈现的概念的提出，大部分网页都是在客户端生成的，使用React.js等JavaScript框架。服务器只生成基本的框架HTML。|2115485|所以，回答你的问题：为什么在登录/注册页面的页面源代码中没有输入标签-这是因为这些输入标签是在客户端使用Javascript生成的。这不会减轻任何安全风险，因为仍然可以通过DOM检查器访问输入标记|2115486|entityMap^0|S|7|0|5|5|0|A|B|0^^$0|@$1|2|3|4|5|6|7|L|8|@$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|O|8|@$9|P|A|Q|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|R|8|@$9|S|A|T|B|C]]|D|@]|E|$]]|$1|J|3|-4|5|6|7|U|8|@]|D|@]|E|$]]]|K|$]]

The browser's page source only displays what is rendered on the server. We call this Server Side Rendering.
These days, with the concept of Client Side Rendering, most of the webpage is generated on the client side, with JavaScript frameworks like React.js. The server just generates the basic skeleton HTML.
So, to answer your question: Why are there no input tags in the page source of login/signup page - This is because these input tags are generated at the client-side using Javascript. This does not mitigate any security risks, as the input tags are still accessible via the DOM inspector

blocks|key|5900477|text|这并不糟糕，只是这些网站的工作方式不同而已。他们可能会使用javascript前端应用程序，并将数据发布到某种形式的后端API来进行登录。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5900478|输入标签来自较旧的web变体，其中服务器准备页面，将其发送到浏览器，浏览器用户填写表单字段，将数据作为编码的表单发送到服务器，服务器准备新的html块并将其发送到浏览器。你会看到页面刷新了不同的内容，海量的html一直在飞来飞去。浏览器使用了一些技巧，使其看起来更像是一种无缝的体验，但仍然存在底层的工作方法，即整个页面被替换|5900479|现代web趋向于单页面应用程序；页面加载了javascript应用程序，并且脚本操纵浏览器文档来绘制UI，不再存在服务器将整个页面批量运送到浏览器以供显示的情况。这一切都是“脚本向服务器发送一些数据(可能是json+)，获得响应并以编程方式更新本地文档，使浏览器更改其显示的内容”|5900480|为此，浏览器在某种程度上已经变成了操作系统或开发环境，具有编程功能，可以访问本地资源，如网络摄像头和文件，它形成了一个前端UI，后端服务器保存并处理使应用程序有价值(值得购买或使用)的数据。它不是关于安全性的，而是关于为基于web的应用程序创建一个现代的、动态的和可用的UI。他们没有理由不使用输入标记；在浏览器中运行的javascript应用程序可以创建一个输入框，用户可以在其中键入内容，javascript应用程序可以从中提取值并将其发送到服务器(而不是以表单形式)并获得响应。只是它们不需要以这种方式工作；有更多的自由来以各种方式获取用户输入，以各种方式将其发送到服务器，并对响应进行操作。我们不再被旧的“向服务器发布表单”的动态内容的方式所束缚，我们也不再被束缚很长时间了，但最近才出现了真正好的框架和库来创建这些单页面应用程序，所以我们越来越多地看到网站使用它们来获得它们提供的好处，它们可能会带来无需使用输入标签就能获得用户输入的方法-这些方法不会受到使用标签所带来的一些限制(可能是样式)。|5900481|现代web主要集中在最终用户体验上，具有更丰富和流畅的ui，传输的数据更少，响应时间更快等。所有这些前端和后端之间的聊天(应该)在现代web中通过HTTPS进行(在高性能服务器和客户端的日子里，加密的CPU成本相对较低)，所以它至少和以前一样安全。|5900482|输入标签的使用频率较低，因为它们的使用频率较低，可能会给现代开发方式带来一些问题和障碍。他们并不是天生就不安全。|5900483|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|P|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|Q|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|R|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|S|8|@]|9|@]|A|$]]|$1|L|3|-4|5|6|7|T|8|@]|9|@]|A|$]]]|M|$]]

It's not bad, it's just not the way those sites work. They likely use a javascript front end app and POST data to a back end API of some sort to do the login.
Input tags hark from an older variation of the web where the server prepared a page, sent it to the browser, the browser user filled in form fields, sent the data to the server as an encoded form, the server prepared a new block of html and sent ti to the browser. You'd see the page refresh with different content and huge amounts of html was flying round all the time. Some tricks were employed by browsers to make it look like a more seamless experience but there is stil lthe underlying method of working, that the whole page was replaced
The modern web tends towards single page applications; a page loads with a javascript application and the script manipulates the browser document to draw the UI, there is never again a situation where the server is wholesale shipping entire pages to the browser for display. It's all &quot;script sends some data, probably json, to the server, gets a response and programmatically updates the local document making the browser change what it displays&quot;
To this end somewhat the browser has become an operating system or development environment, with programming features, and access to local resources like webcams and file, and it forms a front end UI with the back end server holding and processing the data that makes the application valuable (worth purchasing or using). It's not about security, but instead about making a modern, dynamic and usable UI for a web-based application. There's no reason why they could't use an input tag; the javascript app running in the browser could create an input box, the user could type into it, the javascript app could pull the value out of it and send it to the server (not in a form) and get the response.. It's just that they don't need to work that way; there's a lot more freedom to get user input in various ways, send it to the server in various ways and act on the response. We are no longer tied to that older &quot;post a form to the server&quot; way of having dynamic content, and we haven't been tied for a long time but it's relatively more recently that really good frameworks and libraries for creating these single page apps have come along, so increasingly we see sites using them for the benefits they provide and they might bring with them ways of garnering user input without using an input tag - ways that are not subject to some limitation (probably styling) that using the tag incurs.
The modern web is mainly centred on end user experience with a more rich and fluid ui, less data being transferred for faster response times etc. All this chat between front end and back end (should) happens over HTTPS in the modern web (the CPU cost of encrypting being relatively low in these days of high powered servers and clients) so it's at least as secure as it ever was.
TLDR; input tags are less often used because they're less often needed and may bring some problems and blockers to the modern ways of developing. They aren't inherently insecure.

I was going through page source of famous websites like twitter, instagram, snapchat etc. One thing I found common in all these websites is that there are no input tags in the page source of login/signup page. Infact there is no form tag at all. I wonder if its a security measure or something else. Can anyone answer me this?

Is it bad to expose input tags in html source code?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

教程

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云智能顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

EdgeOne AI 安全实战专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

聚焦“写作效率、视觉美观与运行性能”三方面进行全面升级，为您提供更高效、稳定的创作环境

社区富文本&Markdown编辑器全新改版上线，欢迎大家体验!

诚挚邀请您参与本次调研，分享您的真实使用感受与建议。您的反馈至关重要，感谢您的支持与参与！

社区新版编辑器体验调研

我浏览了像twitter，instagram，snapchat等著名网站的页面来源。我发现所有这些网站的一个共同点是，在登录/注册页面的页面来源中没有输入标签。事实上，根本没有表单标签。我想知道这是安全措施还是别的什么。有人能回答我这个问题吗？

问在html源代码中公开输入标签是不是很糟糕？
EN

回答 4

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在html源代码中公开输入标签是不是很糟糕？EN

回答 4

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在html源代码中公开输入标签是不是很糟糕？
EN