I believe sending account and password into url parameters is very easy for someone to sniff these credentials and get access to synology nas. This approach does not take the advantage of http protocol. Parameters should be send as content via https request.
See the reference below
|
login: 'https://{0}:{1}/webapi/SurveillanceStation/ThirdParty/Auth/Login/v1?account={2}&passwd={3}', |
I believe sending account and password into url parameters is very easy for someone to sniff these credentials and get access to synology nas. This approach does not take the advantage of http protocol. Parameters should be send as content via https request.
See the reference below
Synology-Surveillance-API-Samples/ws-player/js/req-utils.js
Line 6 in c16cad5