21 ms·
Right, but your server logs should see the full request (and the keys), no?
by m348e912 3y ago
Right, but your server logs should see the full request (and the keys), no?
- ackatz 3y agoI just see these in my server logs when someone generates a link: INFO: [cloudflare ip]:47174 - "POST /generate_link HTTP/1.1" 200 OK
- m348e912 3y agoSo you don't also see "GET /e47b07057738525b2f77fab1ef3197cac1b27e7672ea1a49bc5ae4f87eb19e8c/73a3257c89dbef144434269df702364eb0422554c508b6433266b4e65d07b344#p3d3pLH7ND2cr6EJztGmQosfPZdItxE_FQ5zCsGZ5bM=/ HTTP/1.1" 200 OK? (That would be a test message I created a link for)
- ackatz 3y agoNo, anything including and after the # is not seen by the server. Here is a screenshot from Fly that shows what it looks like from my end: https://imgur.com/a/41XxtHJ https://imgur.com/a/41XxtHJ If someone were to go to just the /sha256/sha256 link without the encryption key bookmark appended to it, they would see: Decryption failed: ChaCha20Poly1305 key must be 32 bytes. Or with a wrong key they would see: Decryption failed:
- m348e912 3y agoAh clever, that's the part I was missing. Cool idea and implementation. Thanks!