3 ms·
Developer 102 (or perhaps entrance exam): Never return authorization credentials on an unauthenticated HTTP endpoint.
by andrewstuart2 9y ago
Developer 102 (or perhaps entrance exam): Never return authorization credentials on an unauthenticated HTTP endpoint.
- f2n 9y agoIt says Authorization, but this is really more of an anti-CSRF token, not an actual authorization credential, and anti-CSRF tokens are completely legitimate to return over an unauthenticated HTTP endpoint.