AllanJeremy / rain

Rain E-Learning System (EsomoX) Development Build
4 stars 0 forks source link

API vulnerabilities #37

Open AllanJeremy opened 6 years ago

AllanJeremy commented 6 years ago

Current API is vulnerable to attacks as it is 'publicly accessible'. It is also inlined into our database handler files and some class files, which makes it unbearably difficult to maintain. Another problem is the API is made of switch and case statements, this is ... terrible for maintainability and debugging

TODO: [Temporary current fix] Limit the api call support to only work from our servers [Later - when rewriting to work in CodeIgniter] Implement OAuth2 for when we want controlled public access to various sections of our API