search

miguelgrinberg / REST-auth

Example application for my RESTful Authentication with Flask article.
http://blog.miguelgrinberg.com/post/restful-authentication-with-flask
MIT License
921 stars 337 forks source link

A security concern. #7

Closed michaelyousrie closed 7 years ago

michaelyousrie commented 7 years ago

What doesn't allow someone to sniff the request headers and get the credentials used to get the token ?

A note: even if the password is encrypted, the sniffer ( attacker ) can just grab the hashed password since it is what is decrypted at the server ( it won't matter if the password is encrypted or not is what I mean ).

miguelgrinberg commented 7 years ago

You would never be running your production app on a plain http connection. You will be using https, so sniffing is not possible.

michaelyousrie commented 7 years ago

Thank you.