No authentication in task checking about smssync

[olliebennett]

I agree that this would be an improvement.

In order to maintain backwards compatibility with the current process (i.e. server configurations which currently check for the GET parameter ?task=send) how about sending both POST and GET together? That is, send a POST request to your_callback_url?task=send.

As a sidenote, I'm actually satisfied by the level of security offered by the combination of HTTPS POST and the secret/device ID, which sacrifices neither clarity of code nor ease of server development. What would your suggestion be for the "more secure authentication mechanism"?

Combining GET and POST like that is kind of ugly, but so is breaking API. There's probably some combination of server and language that breaks even with that, but probably rather rare.

I would propose that since there's already a user defined secret key(i.e. a password) per sync target, all requests to that target(sending, task checking, potential callbacks) would include in POST these items:

1. Device ID
2. A hash of the secret, concatenated with the device id
   Hash function should be something widely available, like sha512.

[mandric]

I vote for separate settings option to include username/password for HTTP basic auth, that is just used on any request when activated. Basic Auth over https is not so horrible.

[eyedol]

Basic Auth is now supported.