4 ms·

> The services are considered to be in a trusted network and are accessed by a private token passed in the ‘Authorization' header plus the user id of the reques

by gabrtv 12y ago

> The services are considered to be in a trusted network and are accessed by a private token passed in the ‘Authorization' header plus the user id of the requester in an ‘X-USER’ header. This reads like the user ID is exposed in a header without any sort of encryption.

adaml_623 12y ago
What does 'trusted network' mean to you? A lean quick service is not going to want to wait on encryption handshaking.
- wtbob 12y ago
  On modern hardware, I believe AES and SHA-384 are very cheap. But yes, in a private network it's overhead.