API keys in querystrings? about author-tools HOT 3 CLOSED

This is true.
For example following query works:

# as query string
curl https://author-tools.ietf.org/api/render/text?apikey=foobar -F 'file=@./foobar.xml'
# as form parameter
curl https://author-tools.ietf.org/api/render/text -F 'apikey=foobar' -F 'file=@./foobar.xml'

from author-tools.

Does it need to be true? That will cause keys to end up in httpd logs.

from author-tools.

Good point. This doesn't have to be this way. API keys were allowed in query strings to mimic how datatracker API handle requests.
I'll change Author Tools API to not to accept API key as query string.

from author-tools.