List: websecurity@lists.webappsec.org
From: Michal Zalewski
Re: [WEB SECURITY] Password-less login ?
Mon, Jan 28, 2013 5:55 PM
> https://someserver.com/login/a4337bc45a8fc544c03f52dc550cd6e1e87021bc896588bd79e901e2
In general, there are four things to be aware of:
1) Credentials encoded in the URL are very easy to accidentally leak
in any outgoing Referer headers, in screenshots, etc.