search

aaronrenner / phx_gen_auth

An authentication system generator for Phoenix 1.5 applications.
774 stars 56 forks source link

Referrer policy to prevent token leak #41

Closed StephaneRob closed 4 years ago

StephaneRob commented 4 years ago

What do you think about adding a referrer policy header on GET /users/reset_password/:token to prevent token leak via the referrer?

josevalim commented 4 years ago

Hi @StephaneRob! The system was designed so you can't hijack an account with just the token - which is good practice, as it can also leak in logs, exception tracking, etc - so the referer policy is not necessary. But probably something you want to add to your app globally anyway, so go for it. :)