4 ms·
Right, that was implied. You'd need to rate-limit the shortened URL endpoint as well or increase the number of characters. Without it, you could reset a user'
by fullstop 5y ago
Right, that was implied.
You'd need to rate-limit the shortened URL endpoint as well or increase the number of characters. Without it, you could reset a user's password and brute force all shortened possibilities while entering their username. There'd be enough red flags to identify and stop this type of behavior, I think.