Comment 5 for bug 1566416

Revision history for this message
Guang Yee (guang-yee) wrote :

David, one major concern is tempurl, where the signature is part of the URL, in which you shared with others. In that sense, those who have access to the tempurl can easily reconstruct the headers and therefore get a token on behalf of the owner.