carlosvegap / capstone-kickoff

0 stars 0 forks source link

avoid username in requests (impersonate) #50

Closed CarLosVegga closed 1 year ago

CarLosVegga commented 1 year ago

Usually the username/userid is set on the session cookie or through a header. You shouldn't need to explicitly pass this in, since that would let you easily impersonate someone else.

_Originally posted by @vqdo in https://github.com/carlosvegap/capstone-kickoff/pull/45#discussion_r932559554_