willmoss / bitstamp-php-api

PHP API for Bitstamp
19 stars 16 forks source link

Bitstamp security issue #12

Open ghost opened 9 years ago

ghost commented 9 years ago

Bitstamp doesn't have a reference to the post fields in the HMAC signature... This means that any MITM or proxy could change the post fields to alter the API request. The post fields are usually encrypted within the signature to verify the post fields match the signature. This is a Bitstamp security issue, not a security issue of your library.