News for hackers. Stuff that matters.

A comment on GitHub commit search: “remove password”. Parent comment

Re:GitHub commit search: “remove password” by thecrazyone on Wednesday February 15, 2017 @01:18PM (#13654086)
Why would a webhook URL be a secret? Wouldn't it be more like internal API if anything?

I would assume that the parameters sent to the webhook, an auth token or something of the sort would take care of the security bit. Obscuring the URL seems like security-by-obscurity no?

[ Parent | on HN ]
Re:GitHub commit search: “remove password” by ksenzee on Wednesday February 15, 2017 @02:01PM (#13654457)
For purposes of security, there's no difference between example.com/api/my-webhook?auth-token=[some-uuid] and example.com/api/my-webhook/[some-uuid].
[ Parent | on HN ]
Re:GitHub commit search: “remove password” by olalonde on Wednesday February 15, 2017 @02:06PM (#13654508)
Not if you treat the secret URL like a password. Plus, not all webhook callers allow you to authenticate them without supplying them a special URL.
[ Parent | on HN ]