Post #3643651
2026-04-01 12:36 UTC
@bens@mastodon.xyz Hey Ben! Thanks for trying out the app and providing feedback.
I totally hear you, but isn't this approach pretty normal for webhook-like solutions?
I could totally move the secret to an authorization header, but nothing except norms prevents systems from logging that either.
I've considered offering both, though, so anyone who doesn't like it being in the URL can move it to a header.
Replies (1)
-
@bens@mastodon.xyz 2026-04-01 12:40
@simonbs@mastodon.social it's fine for it to be an identifier, but usually combined with an authorization header (or pre-shared secret) it's not that systems _can_ log headers too, it's that URLs are very commonly logged in their entirety. There's a general assumption that the url is fine to be logged. Query string would help in this regard, but I still think auth header is the better approach. I think what you suggest would work well. Existing users wouldn't have to change anything, but people could choose.