3 ms·
I believe the fear here is that if you can guess URLs, and one of those URLs works and provides you with a script that contains an API key, you could use that A
by mfenniak 13y ago
I believe the fear here is that if you can guess URLs, and one of those URLs works and provides you with a script that contains an API key, you could use that API key to perform other, non-Longview-related API calls to Linode's management API.
That's a pretty decent fear. I don't know if there's any other controls on the API key that prevent it from being as vulnerable as this suggests...
- TheSwordsman 13y agoAccording to Linode support, the API key provided is unique to longview and can't be used for anything else.
- jonknee 13y agoIt's a different API key for every Longview machine. I set up 3 and the keys are different in each case (which is also why the short URL changes for each machine, the API key is part of the response and is different for each machine).