5 ms·
Don't forget to paste your auth tokens into a random website today.
by beardedwizard 7y ago
Don't forget to paste your auth tokens into a random website today.
- edoceo 7y agoEveryone: don't use existing please make new, unique keys for services like this. Time-box and revoke!
- iandinwoodie 7y agoCan you please elaborate on what you mean by time-boxing and how you achieve it? I'm assuming it means to assign a time scope to a key and then revoke it's access outside of that time period. This would require access to the API authentication methods, correct? Otherwise, for API's that you don't have backend access to (e.g., GitHub API) you should just generate a token for testing and manually delete it when you are done?
- dennisnedry 7y agoThey mean to assign an expiration date to your tokens. Then when you're done testing, still revoke the token, even if you haven't reached the expiration date.
- edoceo 7y agoThis is exactly what I meant, thank you.
- oauea 7y agoHow does that stop the operator from watching the logs, and stealing all my data?
- vinylkey 7y agoIs it any safer than pasting your auth tokens into a standalone application like Postman? That can just as easily send that information somewhere else, but now you can't press F12, get a network tab, and look at outgoing requests.
- lkschubert8 7y agoYou actually can press CTRL+SHIFT+i to open dev tools in Postman. It is just electron after all. Also even if it were some other UI toolkit you could view the network requests via Fiddler/Wireshark/etc.
- gschier 7y agoFYI, only requests made with the XHR/Fetch APIs in Electron apps show up in the console. Insomnia (I am the maintainer) uses libcurl to send requests, which do not appear in the console. The NodeJS http/https APIs also do not.