4 ms·
Its RESTful yes, but with the wrong item of data. To identify a logged in user and give the user access to their private account data, ONLY EVER use a unique a
by yaix 15y ago
Its RESTful yes, but with the wrong item of data.
To identify a logged in user and give the user access to their private account data, ONLY EVER use a unique and temporal random string. Nothing else. Ever.
Storing that random string in the URL may be done but is more insecure, because it will remain in the browser history. Not good if the user in on a public PC. Better store it in a cookie.
- prodigal_erik 15y ago"Who am I", "which users/accounts may I access", and "which user/account do I want to access right now" are different questions, and it's only the latter that belongs in the URL. I agree that secrets in particular must not be exposed in the URL.