I am hoping someone can make me feel more comfortable about the fact that the CAS RESTful API specifies the TGT in the URL when requesting ST [1]. It is my understanding that you should not put sensitive information in URI's even if it is over HTTPS. This is because URIs are often exposed in http access logs (among other things).
Does anyone have any information on why the TGT isn't in the header and/or why putting the TGT in the URI is safe? Is there a possibility to configure the resource to look in the header instead/also, or does this cause other concerns? Thanks in advance, Rob [1] http://www.ja-sig.org/wiki/display/CASUM/RESTful+API -- You are currently subscribed to [email protected] as: [email protected] To unsubscribe, change settings or access archives, see http://www.ja-sig.org/wiki/display/JSG/cas-dev
