Timeline for apiFetch security
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 15, 2020 at 3:15 | vote | accept | Tom | ||
| Nov 15, 2020 at 1:16 | answer | added | Tom J Nowell♦ | timeline score: 0 | |
| Nov 15, 2020 at 1:13 | comment | added | Tom J Nowell♦ |
I don't believe this is secure, but not because of the method used, but the ability to update an arbitrary setting is itself insecure. Instead of an endpoint that accepts generic options, you should have individual endpoints for specific things. Also, you should have named the endpoint settings rather than update_settings, as it's the HTTP method not the name of the endpoint that's meant to indicate the action, e.g. GET retrieves data, POST/UPDATE/PUT adds or updates data, DELETE deletes it
|
|
| Nov 15, 2020 at 1:05 | review | First posts | |||
| Nov 16, 2020 at 15:38 | |||||
| Nov 15, 2020 at 0:57 | history | asked | Tom | CC BY-SA 4.0 |