5 ms·
This solution is insecure. Any person can intercept token and make harm to your application.
by AlexWhite_ 10y ago
This solution is insecure. Any person can intercept token and make harm to your application.
- xmrcivicboix 10y agoI completely agree. Hence I said it's temporary. When you have a huge influx of paying customers who cannot log in to do their work, you have to balance that a bit.
- svens_ 10y agoIt doesn't seem too bad when enforcing https (using the return address whitelisting in the developer console). Am I missing something?
- AlexWhite_ 10y agoCustomer will see token anyway
- svens_ 10y agoAh yes, of course. I did miss that. The implicit (client-side) auth flow gets the access token directly and doesn't need another request to the API, that's the whole point. This is indeed rather unwanted, even more so with the new more restrictive API usage policy and the sandbox.