News for hackers. Stuff that matters.

A comment on API Shouldn't Redirect HTTP to HTTPS. Parent comment

Re:API Shouldn't Redirect HTTP to HTTPS by gruez on Tuesday May 28, 2024 @11:29PM (#40508148)
There's complicated authentication schemes around hmac that tries to do this, but if you're putting that much effort into it you might as well give up and use https.
[ Parent | on HN ]
Re:API Shouldn't Redirect HTTP to HTTPS by dcow on Wednesday May 29, 2024 @02:10AM (#40508984)
Some of these include a nonce and/or are deployed over TLS to prevent replay attacks and avoid sending bearer tokens over the wire. AWS sig v4 and RFC7616 come to mind.
[ Parent | on HN ]