[
https://issues.apache.org/jira/browse/GUACAMOLE-956?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17457485#comment-17457485
]
Mike Jumper commented on GUACAMOLE-956:
---------------------------------------
Per https://github.com/apache/guacamole-client/pull/649, I'll avoid the
WebSocket for now, as the general consensus is that the same concerns do not
apply as they would for HTTP:
* https://stackoverflow.com/a/65001506
*
https://faqs.ably.com/is-it-secure-to-send-the-access_token-as-part-of-the-websocket-url-query-params
Should it be decided that this needs to be avoided, as well, a nonce seems the
best way to go.
> Migrate away from including auth token within REST API URLs
> -----------------------------------------------------------
>
> Key: GUACAMOLE-956
> URL: https://issues.apache.org/jira/browse/GUACAMOLE-956
> Project: Guacamole
> Issue Type: Improvement
> Components: guacamole
> Reporter: Mike Jumper
> Assignee: Mike Jumper
> Priority: Minor
> Fix For: 1.4.0
>
>
> Guacamole's current REST API relies on including the user's auth token within
> the {{token}} query parameter. Using a query parameter in this way is
> generally regarded as bad practice, as other software between the user and
> the webapp may log the content of URLs and GET requests insecurely, including
> these parameters.
> We should instead leverage HTTP headers, allowing the {{token}} parameter to
> be used only for compatibility's sake.
--
This message was sent by Atlassian Jira
(v8.20.1#820001)
