Send user identifier along with the bearer token about ember-simple-auth

[marcoow]

Not sure about the security aspect actually. When I can get your bearer token (which means I either have access to your machine or can intercept your network traffic), there's no reason I couldn't get your Login or Email.

However, adding that will be really simple when I release the big strategies refactoring (I hope end of next week - had to delay it a little).

[brandonparsons]

Perhaps that is true. My thought was just that if you are directly looking up the bearer token amongst all tokens that exist on your app, it is far easier than a hacker having to guess both an email AND a token. A person going nuts on the command line with curl could set HTTP Authorization headers at random until they got one right.

[marcoow]

If it's possible to guess the token with curl on the command line than you need better (longer/more complex) tokens ;)

Am 30.11.2013 um 19:26 schrieb brandonparsons [email protected]:

Perhaps that is true. My thought was just that if you are directly looking up the bearer token amongst all tokens that exist on your app, it is far easier than a hacker having to guess both an email AND a token. A person going nuts on the command line with curl could set HTTP Authorization headers at random until they got one right.

—
Reply to this email directly or view it on GitHub.