4 ms·
Am I right that for browser use case this mechanism can be used only to authorize access to resources that are requested with JavaScript? For example, I can't
by mixedbit 13y ago
Am I right that for browser use case this mechanism can be used only to authorize access to resources that are requested with JavaScript?
For example, I can't use an 'img' HTML tag to include images that require authorization, because browser won't set a Bearer header while requesting images?
- woloski 13y agoFor images that are protected you can use this approach http://blog.auth0.com/2014/01/27/ten-things-you-should-know-about-tokens-and-cookies/#file-downloads http://blog.auth0.com/2014/01/27/ten-things-you-should-know-...
- mixedbit 13y agoBut with tokens in URLs you can do CSRF.
- jfroma 13y agoNo, you need the signed token for the link, that will only works for that particular url (protocol, host, path, query), for a breve period of time and only for GETs. As mentioned in the blog post, you can check hawk bewits: https://github.com/hueniverse/hawk https://github.com/hueniverse/hawk