News for hackers. Stuff that matters.

A comment on Is Your Site Leaking Password Reset Links?.

Re:Is Your Site Leaking Password Reset Links? by mmanulis on Monday October 24, 2016 @11:51AM (#12779892)
Why not pass the token as an HTTP header? e.g. X-RESET-TOKEN=foo and then read that via JS
[ Parent | on HN ]
Re:Is Your Site Leaking Password Reset Links? by dom0 on Monday October 24, 2016 @02:01PM (#12781165)
How exactly do you encode a HTTP header into an URL?
[ Parent | on HN ]
Re:Is Your Site Leaking Password Reset Links? by derekprior on Monday October 24, 2016 @01:48PM (#12781055)
You can't set an HTTP Header with an HTML link.

Would be nice to set a body though, wouldn't it? Also, not allowed by HTML.

[ Parent | on HN ]