4 ms·
If the key is just in the URL, what's stopping them from simply obtaining the key out of their access logs and decrypting whatever they want?
by sli 3y ago
If the key is just in the URL, what's stopping them from simply obtaining the key out of their access logs and decrypting whatever they want?
- leesalminen 3y agoPresumably they’re placing it in the # part of the url, which isn’t passed to servers by browsers. Now, of course, the client could still exfiltrate the key with client side JS, but that would be noticeable to anyone that wanted to check.