Closed symm closed 6 years ago
Definitely agree with the idea behind this. Thanks for the suggestion. We don't want to expose the SHA1 of every password checked in the cache directory.
I'd prefer to use the existing PSR-6 caching though. So rather than caching full requests via Guzzle middleware, I'd like to just cache the response body, and change the cache key to be only the first 5 characters of the SHA1.
I'm continuing this in PR #9.
It's possible to recover the SHA1 of every password checked in the last 30 days by browsing the
/tmp/password-exposed-cache
folder.Example
Output:
PR changes to caching the API response instead.