CODEWITHSUNDEEP
djangodjango-piston
CardinalCary Cary
CardinalCary Cary

Reputation: 1

What is the reason that Piston needs to remove the OAuth keys from the request?

I posted the question in here as well but dont seem get answered.. https://bitbucket.org/jespern/django-piston/issue/194/what-is-the-reason-that-piston-needs-to

Upvotes: 0

Views: 45

Answers (1)

Evan Porter
Evan Porter

Reputation: 2977

If I understand correctly, it's doing so for security purposes.

The Resource class handles authentication using the request object, then removes the OAuth headers from the request before the given handler is called. Generally, you'll want to limit the visibility of things like these. If you limit exposure of private information like keys, etc, you can potentially limit vulnerabilities.

Upvotes: 0

Related Questions