News for hackers. Stuff that matters.

A comment on I made nodb, a RESTFful API to store and fetch JSON. Parent comment

Re:I made nodb, a RESTFful API to store and fetch JSON by dndn1 on Saturday May 27, 2023 @08:16AM (#36094103)
A stackoverflow answer on this:

https://stackoverflow.com/a/499594

I don't think proxy servers or sniffers see GET data - it's encrypted, assuming HTTPS of course. Server logs might be an issue. Browser logs and accidentally sharing is definitely a bigger issue. Less of a concern if API is only used behind the scenes by apps though.

Disclaimer: I'm not an auth expert!

[ Parent | on HN ]
Re:I made nodb, a RESTFful API to store and fetch JSON by justsomehnguy on Saturday May 27, 2023 @08:25AM (#36094158)
> I don't think proxy servers

Proxies with MITM (mostly corporate) would see everything, because they are terminating client SSL/TLS.

[ Parent | on HN ]
Re:I made nodb, a RESTFful API to store and fetch JSON by dndn1 on Saturday May 27, 2023 @12:14PM (#36095871)
MITM will see everything, but this should be the case with headers as well as GET params, passwords/tokens/data etc.
[ Parent | on HN ]
Re:I made nodb, a RESTFful API to store and fetch JSON by justsomehnguy on Saturday May 27, 2023 @03:12PM (#36097347)
In case there is no MITIM but the original link was written using the plain HTTP then the proxy would see it anyway, before upgrading to SSL CONNECT.
[ Parent | on HN ]