10 ms·
Please, do NOT sign up in this site until author fixes this noobish vulnerability: When the sign up request is sent, it shows a S3 error not finding correspond
by jomendoz 7y ago
Please, do NOT sign up in this site until author fixes this noobish vulnerability:
When the sign up request is sent, it shows a S3 error not finding corresponding key. The true misdeed is requesting the resource with get and passing email and password as query parameters in the URL. Such a shame >-(
- bucket2015 7y agoFixed.
- grepthisab 7y agoIsn't this pretty similar to basic auth? Passing credentials in plaintext but over TLS.
- jomendoz 7y agoYes. But URLs tent to be logged more than HTTP headers or payloads. Any L7 proxy can spit out requested paths and the password will be preserved in different places for long periods of time.
- grepthisab 7y agoAh, that makes sense. Thanks!