3 ms·
I'd like a standardized token syntax that contains a domain (e.g. `secret:example.com/token`) Then you could fetch an url like `https://example.com/.well-known/
by CodesInChaos 4y ago
I'd like a standardized token syntax that contains a domain (e.g. `secret:example.com/token`) Then you could fetch an url like `https://example.com/.well-known/secret-leak https://example.com/.well-known/secret-leak` which returns machine readable information about how to report a leaked token.
- remram 4y agoI keep arguing for this too! [1][2][3] A few cycles ago [4] sudhirj pointed out that you could just use an actual URL as your secret key and have that be the URL you visit to revoke it, and I think that is genius. [1] https://news.ycombinator.com/item?id=34009442 https://news.ycombinator.com/item?id=34009442 [2] https://news.ycombinator.com/item?id=31335081 https://news.ycombinator.com/item?id=31335081 [3] https://news.ycombinator.com/item?id=25979908 https://news.ycombinator.com/item?id=25979908 [4] https://news.ycombinator.com/item?id=28299624 https://news.ycombinator.com/item?id=28299624