Subscription.header is a security escalation waiting to happen.

XMLWordPrintableJSON

    • Type: Question
    • Resolution: Unresolved

      Given this guideline (which I agree with) Subscription.header is a problematic feature.

      Existing Wording:

      Subscription resources are not intended to be secure storage for secrets (e\.g\., OAuth Client ID or Tokens, etc\.)\. Implementers MAY use their judgement on including limited-use secrets (e\.g\., a token supplied in Subscription\.header to verify that a message is from the desired source)\.

      (Comment 25 - imported by: Gino Canessa)

            Assignee:
            Unassigned
            Reporter:
            Isaac Vetter
            Watchers:
            1 Start watching this issue

              Created:
              Updated: