Comment on Encrypted DNS and NTP = DeadlockparentComments−ThePowerOfFuet3yWhy does Screenly have their API available on port 80 at all? Great way to leak cookies or tokens...−mvip3yWe obviously don't use HTTP for serving our API. The HTTP end-point is just a 301, but it still contains the Date field:$ curl -I http://api.screenlyapp.comHTTP/1.1 301 Moved PermanentlyDate: Fri, 30 Dec 2022 09:01:44 GMT [...]−ThePowerOfFuet3yRegardless of it being a 301, the cookie or token is already sent, and thus already burned, by the time the response code is returned.Your API should not even be listening on port 80, period.
Comments
Why does Screenly have their API available on port 80 at all? Great way to leak cookies or tokens...
We obviously don't use HTTP for serving our API. The HTTP end-point is just a 301, but it still contains the Date field:
$ curl -I http://api.screenlyapp.com
HTTP/1.1 301 Moved Permanently
Date: Fri, 30 Dec 2022 09:01:44 GMT [...]
Regardless of it being a 301, the cookie or token is already sent, and thus already burned, by the time the response code is returned.
Your API should not even be listening on port 80, period.