This repository was archived by the owner on Jul 7, 2021. It is now read-only.
This repository was archived by the owner on Jul 7, 2021. It is now read-only.
client/user token implementations leak credentials in logs #243
Description
Hi,
As both client and user token implementations use query strings, the credentials can actually leak in any logs on the server (mine/our/the clients). It is preferred to actually include them in the request body instead. Quoting the api doc:
• Even though finAPI is not logging query parameters, it is still recommended to pass the parameters in the POST body instead of in the URL. Also, please set the Content-Type of your request to 'application/x-www-form-urlencoded' when calling this service.
Relevant: #37