Background
I’m working on an application for my own needs, with some very lightweight frameworks. I don’t want to spend time on user previlegies, logins and so on. No one but me will use it.
My question
Let’s say I want be able to add or delete anything in my database when visiting this address:
http://www.example.com/?secret=eccbc87e4b5ce2fe28308fd9f2a7baf3
No login, just this address. How secure is that? If it’s not secure, what would be a good simple solution?
My thoughts
- No one can guess that secret key.
- Can robots find out about it if there is no link to it?
If its not going over SSL then it can be sniffed too. If you update on public wifi anyone can see the value. Though its quite unlikely anyone will be sniffing for your website