ChanServ changed the topic of #sandstorm to: Welcome to #sandstorm: home of all things Sandstorm and Cap'n Proto. Say hi! | Have a question but no one is here? Try asking in the discussion group: https://groups.google.com/group/sandstorm-dev | Channel logs available at https://libera.irclog.whitequark.org/sandstorm
<ill_logic> So it seems like the purpose of a cookie secret is add signatures to session ids to make sure nobody can hijack another user.
<ill_logic> Seems like I wouldn't need to worry so much about that if it's packaged by Sandstorm?
<ill_logic> Hmm. Actually maybe not. if the app's session id is in a different cookie than Sandstorm's, a different sandstorm user might still try to hijack another session in the app?
<isd> Not familiar with etherpad's internals, but often those types of things are also used for CSRF tokens, which sandstorm does not totally obviate currently.
<ocdtrekkie> Yeah, the risk of someone impersonating another in an Etherpad document is probably low, but arguably technically a possibility?
<isd> I think it is prudent to assume the cookie secret is necessary even in Sandstorm.
TMM_ has quit [Quit: https://quassel-irc.org - Chat comfortably. Anywhere.]
TMM_ has joined #sandstorm
<ill_logic> 👍️
<ill_logic> Does anybody know/remember anything about API access to etherpad-sandstorm?
<ill_logic> There was a change allowing a few API functions, but no apiPath in pkgdef. Something incomplete that was never used?
<ill_logic> It doesn't seem to be called during normal use by the client. I'd assume they'd use sockets for that stuff.
<ill_logic> "there was a change" meaning in the previous version of etherpad-sandstorm
<ill_logic> If it's incomplete and unused, I'll just block API access instead.
<ocdtrekkie> I wasn't aware of any API use.
<ill_logic> Actually it's looking for x-sandstorm-permissions so it's not even assuming it's an API call.
<ill_logic> I'll just axe it with a comment then. Doesn't make any sense to me.
TMM_ has quit [Quit: https://quassel-irc.org - Chat comfortably. Anywhere.]
TMM_ has joined #sandstorm