Reveal API credentials

[feri]

One might be able to find out all API credentials of a Glome enabled app using this proxy. A simple request will do the trick: http://wallet.glome.me:8080 which will redirect to the API server having the credentials as GET parameters.

This should not be allowed.

[jemiweb]

Hats off - good that you have a "inner protocol" to think security!

On 25 Feb 2015, at 09:32, Ferenc Szekely notifications@github.com wrote:

One might be able to find out all API credentials of a Glome enabled app using this proxy. A simple request will do the trick: http://wallet.glome.me:8080 which will redirect to the API server having the credentials as GET parameters.

This should not be allowed.

—
Reply to this email directly or view it on GitHub.