AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-26 18:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Read API credential decrypt password from body instead of query string

Browse Source 
Keeps the credential decryption secret out of the URL, so it no longer lands in web-server access logs, proxy logs, or browser history. credentials/read.php now reads api_key_decrypt_password from the request body, matching create/update. Consumers reading decrypted credentials must send it in the body, not the query string.
This commit is contained in:
johnnyq
2026-07-25 17:08:22 -04:00
parent e6daf00528
commit 04bf3c234f
3 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
api/v1/credentials/read.php
View File

@@ -8,8 +8,10 @@ require_once '../require_get_method.php';
$sql = false;
$api_key_decrypt_password = '';
if (isset($_GET['api_key_decrypt_password'])) {
$api_key_decrypt_password = $_GET['api_key_decrypt_password']; // No sanitization
if (isset($_POST['api_key_decrypt_password'])) {
// Read from the request body (parsed by validate_api_key.php), NOT the query string,
// so this decryption secret never lands in web-server access logs or browser history.
$api_key_decrypt_password = $_POST['api_key_decrypt_password'];
}
// Specific credential/login via ID (single)