search

knowmetools / km-api

The API behind our Know Me app
Apache License 2.0
4 stars 0 forks source link

The Apple receipt query endpoint is available from too many URLs #505

Closed cdriehuys closed 5 years ago

cdriehuys commented 5 years ago

Environment (production/development) Occurs in: production

Describe the bug The endpoint for querying for an Apple receipt is accessible from any URL prefixed with /know-me/subscription/apple/, eg /know-me/subscription/apple/foobar/.

Expected behavior The endpoint is only intended to be accessed from /know-me/subscription/apple/query/.