Skip to content
This repository has been archived by the owner on Jan 28, 2023. It is now read-only.

Security risk - printing raw server key #235

Open
YouHaveTrouble opened this issue Feb 9, 2021 · 1 comment
Open

Security risk - printing raw server key #235

YouHaveTrouble opened this issue Feb 9, 2021 · 1 comment

Comments

@YouHaveTrouble
Copy link
Contributor

There is currently security risk with WooMinecraft logging connection url when it gets unexpected response.

There isn't a given that all people having access to console have access to the woocommerce shop key. This can result in possible sabotage where someone would set up a server with the key and redeemed the purchases there instead of the server it's supposed to.

Best way to fix this is to send the server key in a header instead of in the url and display the data based on header rather than raw url on wp plugin side.

@JayWood
Copy link
Member

JayWood commented Feb 13, 2021

Valid point, this seems like a regression as I was originally replacing the server key, not sure what happened.

@JayWood JayWood added this to the Next Release milestone Feb 13, 2021
@JayWood JayWood added this to TODO in Next Release Feb 13, 2021
@JayWood JayWood added this to To do in 2.0 Release Dec 27, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
Development

No branches or pull requests

2 participants