3 ms·
I think inserting credentials in a URL in the first place is the problem. Always send it in the request body. Never configure a webserver to log request bodies,
by rmbyrro 4y ago
I think inserting credentials in a URL in the first place is the problem. Always send it in the request body. Never configure a webserver to log request bodies, they'll eventually contain sensitive information.
- bastawhiz 4y agoYou're assuming they were in the URL and that only the URL was logged. APIs are extremely fraught, because users like to build integrations that jam credentials into the wrong places until they get a 200. You haven't lived until you've added a regexp for your API keys appearing in the wrong HTTP headers