Hacker News new | ask | show | jobs
by dndn1 1119 days ago
A stackoverflow answer on this:

https://stackoverflow.com/a/499594

I don't think proxy servers or sniffers see GET data - it's encrypted, assuming HTTPS of course. Server logs might be an issue. Browser logs and accidentally sharing is definitely a bigger issue. Less of a concern if API is only used behind the scenes by apps though.

Disclaimer: I'm not an auth expert!
1 comments
justsomehnguy 1119 days ago
> I don't think proxy servers

Proxies with MITM (mostly corporate) would see everything, because they are terminating client SSL/TLS.

link
dndn1 1119 days ago
MITM will see everything, but this should be the case with headers as well as GET params, passwords/tokens/data etc.
link
justsomehnguy 1119 days ago
In case there is no MITIM but the original link was written using the plain HTTP then the proxy would see it anyway, before upgrading to SSL CONNECT.
link