81778a2c2d
The API key is no longer sent as plaintext in HTTP responses. Instead, the frontend performs a reveal handshake: fetches the server's RSA public key, generates a session AES-256 key, RSA-OAEP wraps it, and the server returns the API key encrypted with AES-GCM. This protects the bearer token even when Studio is served over plain HTTP. |
||
|---|---|---|
| .. | ||
| data_recipe | ||
| export | ||
| inference | ||
| training | ||
| __init__.py | ||