lincolnloop/raven-js — Issue #2: Better non-signing implementation
Author: dcramer
Created: 2012-02-03 01:07:17+00:00
State: open

We need to implement some behavior in Sentry (so this ticket applies to both raven-js and Sentry) that removes the need for Raven to send a signed request. The signed request in JS doesn't actually provide any benefit, as it exposes the signing key (secret key).

Two things we should do:

1. Implement ProjectDomain (model exists in Sentry, but its not implemented yet) to check for whitelisted trusted domains.
2. Fully support non-signed requests officially. This should probably just be public key to allow it, and should not be enabled in Sentry by default. Possibly make it a per-project option that says "allow public errors" which dont require the secret key or a signed request.