3 ms·
Why does Screenly have their API available on port 80 at all? Great way to leak cookies or tokens...
by ThePowerOfFuet 4y ago
Why does Screenly have their API available on port 80 at all? Great way to leak cookies or tokens...
- mvip 4y agoWe obviously don't use HTTP for serving our API. The HTTP end-point is just a 301, but it still contains the Date field: $ curl -I http://api.screenlyapp.com http://api.screenlyapp.com HTTP/1.1 301 Moved Permanently Date: Fri, 30 Dec 2022 09:01:44 GMT [...]
- ThePowerOfFuet 4y agoRegardless of it being a 301, the cookie or token is already sent, and thus already burned, by the time the response code is returned. Your API should not even be listening on port 80, period.