Skip to content
Snippets Groups Projects
Commit b2aa9e11 authored by Andrea Scarpino's avatar Andrea Scarpino
Browse files

Drop the redundant private_token GET parameter

Quoting from the GitLab API: "You can use a personal access token to authenticate with the API by passing it in either the private_token parameter or the Private-Token header.".

By using it as GET parameter we expose our tokens to sniffing!
parent 078cec7f
No related branches found
No related tags found
No related merge requests found
Loading
Loading
@@ -25,10 +25,6 @@ class AuthenticationRequestInterceptor(private val account: Account) : Intercept
if (isSameServer(url.toString(), serverUrl)) {
val privateToken = account.privateToken
privateToken?.let {
url = url.newBuilder()
.addQueryParameter(PRIVATE_TOKEN_GET_PARAMETER, it)
.build()
request = request.newBuilder()
.header(PRIVATE_TOKEN_HEADER_FIELD, it)
.url(url)
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment