4 ms·
Not true. I can have a service monitor "http://foo:bar@mysite.com/password/protected/endpoint/ http://foo:bar@mysite.com/password/protected/endpoint/ or "http:/
by cheald 15y ago
Not true. I can have a service monitor "http://foo:bar@mysite.com/password/protected/endpoint/ http://foo:bar@mysite.com/password/protected/endpoint/ or "http://mysite.com/protected?auth_token=2caf5e77cfa057ad2f36e6fafd2b95787dd5a5edfdbeae8f73a5f7a7f892fb0a5f83d http://mysite.com/protected?auth_token=2caf5e77cfa057ad2f36e... just fine.
Passwords are security by obscurity, sure, but putting them in a world-readable file at a common known location is the height of ridiculous.
- icebraining 15y agoThen you can put monitor.txt behind that password protected endpoint too. My point is that whoever you need to give access to the file also has access to the actual website, which has all the information (it has to, since it's supposed to be able to test against it).