Security issue when include token in url

mbleigh / omniauth-jwt

An OmniAuth strategy that uses JSON Web Token for Single Sign-On

MIT License

101 stars 46 forks source link

Security issue when include token in url #4

Open kidphys opened 9 years ago

kidphys commented 9 years ago

Correct me if I'm wrong, but is it unsecured to include the token in the redirection url? Any host standing in between may intercept and extract the token at will.

rubyconvict commented 7 years ago

HTTPS is required. DNS, browser history, proxies can be problematic, so I guess, the use case here is the same as in Oauth 2.0 - provider must issue a short-lived token (requiring a refresh).

pboling commented 7 months ago

FYI: I rewrote this gem and modernized it!

https://github.com/pboling/omniauth-jwt2