List: websecurity@lists.webappsec.org
From: Nick Nikiforakis
Re: [WEB SECURITY] Password-less login ?
Mon, Jan 28, 2013 6:19 PM
@coredump.cx>wrote:
> >
> https://someserver.com/login/a4337bc45a8fc544c03f52dc550cd6e1e87021bc896588bd79e901e2
>
> In general, there are four things to be aware of:
>
> 1) Credentials encoded in the URL are very easy to accidentally leak
> in any outgoing Referer headers, in screenshots, etc.