Post #1456296
2026-04-01 12:32 UTC
@simonbs just now trying out brrr and noticed that the user key is part of the url.
I would suggest implementing an authorization header strategy instead. URLs are likely to be logged by middleware, web servers, etc and would expose this secret wider than should be allowed.
Replies (1)
-
@simonbs@mastodon.social 2026-04-01 12:36
@bens@mastodon.xyz Hey Ben! Thanks for trying out the app and providing feedback. I totally hear you, but isn't this approach pretty normal for webhook-like solutions? I could totally move the secret to an authorization header, but nothing except norms prevents systems from logging that either. I've considered offering both, though, so anyone who doesn't like it being in the URL can move it to a header.