Skip to content

Conversation

d-velev
Copy link
Contributor

@d-velev d-velev commented Dec 14, 2017

closes #134

Copy link
Contributor

@cytadela8 cytadela8 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good!
If we would like to be more security concerned if env_authorization == header_authorization do creates a possibility of a timing attack where attacker guesses the env_authorization one byte at a time due to the fact the comparison is not constant time. But such problems are not our concern for now. eg. In future the private API will be only available locally.

env -> env
end

# config :aecore, :authorization,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we remove this?

@thepiwo
Copy link
Collaborator

thepiwo commented Dec 15, 2017

@meivantodorov @andonov can you approve?

@thepiwo thepiwo merged commit e15b548 into master Dec 15, 2017
@thepiwo thepiwo deleted the GH-134 branch October 5, 2018 11:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

api functions protected by key, to control node

4 participants