3 ms·
Keep in mind that urls end up in logs, that might well not be so well protected
by g-b-r 3y ago
Keep in mind that urls end up in logs, that might well not be so well protected
- EE84M3i 3y agoParticularly if you use cdns, tracing, analytics, etc. Also, IIRC a parent frame can retrieve a child frame's current URL no matter what.
- bob1029 3y agoIn our case this is fine. The URL doesn't pass any claims. It is opaque client state bound to a specific identity which is validated by other means.