3 ms·
It wouldn't work to make the user perform the HMAC, since it requires having the secret, and then the user could share the secret. You need the server to calcul
by egwynn 13y ago
It wouldn't work to make the user perform the HMAC, since it requires having the secret, and then the user could share the secret. You need the server to calculate
magic = HMAC(secret, username)
and then give 'magic' back to the user. And then the server can decide whether the (username, magic) pair is valid.
- skrebbel 13y agoyou could still require the user to HMAC too, just for filter's sake :-) alternatively, make the 'submit job' feature only available as a (documented) HTTP POST operation without any matching HTML form.
- tracker1 13y agoThen the recruiting companies will just pay a dev to write a tool for them to bulk post job req's all day.