C.W.K.
Stream
Quiz · 4 questions

🔑 The Handoff Is Identity-Only

A URL that carries a capability, never a path — and why both sides still check

Level 0Reel Novice
0 XP0/39 lessons0/12 achievements
0/100 XP to next level100 XP to go0% complete

Quiz

01What does the cwkashenreel:// deep link carry?
02Why would putting a file path in the deep link be a confused-deputy vulnerability?
03Ashen Reel resolves the video_id through the loopback Recall API and gets back a path. What must it still do before opening the file?
04A user drags a file from Finder onto Ashen Reel. That file URL is a real path. Does it violate the identity-only rule?
Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)
Sign inPlease sign in to comment.

No comments yet — be the first.