4 ms·
Congratulation on shipping! The experience was flawless and quick. Two things I noticed which I hope you will consider fixing: - It was trivially easy to expo
by keehun 5y ago
Congratulation on shipping! The experience was flawless and quick.
Two things I noticed which I hope you will consider fixing:
- It was trivially easy to expose the user's google/gmail address by typing in a random URL within the user's blog. The 404 page exposes the user's email address. [0] Probably better to have some UUID-email mapping that is secret.
- When I clicked "Delete Account/Blog", the application did not remove itself from Google's "Apps with access to your account" page and was still showing up as an active integration.
[0]: https://i.imgur.com/PG8Em4S.png https://i.imgur.com/PG8Em4S.png
- lewisjoe 5y agoThank you for pointing this out. #1 - I'll deactivate debug mode ASAP and the 404 page shouldn't have any extra info henceforth. #2 - Yes, it's better to revoke google's scopes as well. I'll work on this one.
- throwaways885 5y agoDjango debug is quite dangerous to expose online. Are you hosting this on your own computers?
- lewisjoe 5y ago> It was trivially easy to expose the user's google/gmail address by typing in a random URL within the user's blog. This one is fixed now!