Forced migration to Google Sheets API v4

Re:Forced migration to Google Sheets API v4 by tyingq on Wednesday January 15, 2020 @08:37AM (#22053983)

Maybe consider a configurable option for the token to only work as a POST payload, versus a url parameter. When they get passed around as urls in email, etc, they tend to get exposed pretty quickly. Breaks standard REST, but...

Or maybe some shared secret challenge/response to get a time limited ticket?

[ Parent | on HN ]

Re:Forced migration to Google Sheets API v4 by davedx on Wednesday January 15, 2020 @09:42AM (#22054514)

I'll almost certainly have it only allowed in headers irregardless of the HTTP verb used. This does mean you won't be able to use your browser to test GET's, but this feature is squarely aimed at developers who will probably be using a Postman like tool to test with.

[ Parent | on HN ]

Re:Forced migration to Google Sheets API v4 by cwivbly on Wednesday January 15, 2020 @10:29AM (#22055030)

> I'll almost certainly have it only allowed in headers irregardless of the HTTP verb used. This does mean you won't be able to use your browser to test GET's,

There is very probably a way to (ab)use HTTP Auth for this such that it's still possible to test GETs with simple URL strings or links in a browser.

[ Parent | on HN ]

Re:Forced migration to Google Sheets API v4 by jmull on Wednesday January 15, 2020 @09:40AM (#22054494)

I wonder if a header would be a good place for a token.

It won't get exposed like a URL parameter and doesn't misuse the body/POST.

[ Parent | on HN ]