Re:Why I avoid SDKs in production
by nl on Wednesday February 05, 2014 @05:50AM
(#7183010)
Err.. why?
Clearly the keys need to be obtained somehow, but that was out of band for my application. Once they are obtained I don't see any reason why passing them from a 3rd party app over HTTPS (using CORS) is any less secure than using session based authentication with a 1st party app.
In both cases you are vulnerable to MTM and XSS attacks. Sessions expire which is nice, but that's the only real difference.
Clearly the keys need to be obtained somehow, but that was out of band for my application. Once they are obtained I don't see any reason why passing them from a 3rd party app over HTTPS (using CORS) is any less secure than using session based authentication with a 1st party app.
In both cases you are vulnerable to MTM and XSS attacks. Sessions expire which is nice, but that's the only real difference.