3 ms·
If users login through some web form the credentials can end up in a log because the web server logs the form parameters (or the URL and the parameters are in t
by tinus_hn 4y ago
If users login through some web form the credentials can end up in a log because the web server logs the form parameters (or the URL and the parameters are in the URL). Not good but it happens.
- rmbyrro 4y agoI think inserting credentials in a URL in the first place is the problem. Always send it in the request body. Never configure a webserver to log request bodies, they'll eventually contain sensitive information.
- bastawhiz 4y agoYou're assuming they were in the URL and that only the URL was logged. APIs are extremely fraught, because users like to build integrations that jam credentials into the wrong places until they get a 200. You haven't lived until you've added a regexp for your API keys appearing in the wrong HTTP headers