3 ms·
A lot of text for your argument which is x isn't secure. Not very compelling. Signed rest requests ensure that auth tokens can not be leaked as each request
by Blazespinnaker 9y ago
A lot of text for your argument which is x isn't secure. Not very compelling.
Signed rest requests ensure that auth tokens can not be leaked as each request is individually signed by a private key.
Your extreme example btw is hyperbolic. Providing signing sample code to clients is pretty typical
- tptacek 9y agoI'm explaining where I'm coming from as a courtesy. I am also comfortable with the number and kind of HN readers who would simply take my argument as-stated without justification: "don't do signed URLs if you can get away with bearer tokens".