Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(channel-web): refactor of the webchat API #4578

Merged
merged 3 commits into from Mar 3, 2021
Merged

Conversation

allardy
Copy link
Member

@allardy allardy commented Mar 3, 2021

The userId and convoId was removed from the URL and is now sent as POST data instead.

This will prevents web servers from logging any user data and requests will be anonymous.
When combined with the rate limiting, this should prevent an attacker to brute force user IDs

In a future PR, once the initial handshake is completed, the ID sent in the post data will be temporary

@allardy allardy requested a review from EFF March 3, 2021 16:47
@allardy allardy changed the title fix(channel-web): remove userId from url fix(channel-web): remove userId and convoId from url Mar 3, 2021
@allardy allardy changed the title fix(channel-web): remove userId and convoId from url fix(channel-web): refactor of the webchat API Mar 3, 2021
Copy link
Member

@EFF EFF left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM let's merge this

@allardy allardy merged commit e9e9cad into master Mar 3, 2021
@EFF EFF mentioned this pull request Mar 5, 2021
@allardy allardy deleted the ya-channelweb-api branch March 18, 2021 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants