Yesterday Ren\u00e9\u00a0commented that submitting\u00a0username and password with HTTP GET is insecure, because they\u00a0are submitted in clear text over the wire as part of the URI.<\/p>\n
At the first moment, I did not give some thought about it,\u00a0because it is known fact that data added to an\u00a0URI are less secure. They are added to the browser history, are logged in the requests on servers, and every proxy between the user’s browser and the requested server\u00a0are seeing (and maybe logging) these URI’s too. That’s why HTTP GET is problematic:\u00a0The credentials are accidentially spread over the whole world, like any other information which are appended to an URI.<\/p>\n
In\u00a0Ren\u00e9’s example, he pointed out that a\u00a0hotspot provider of a public WiFi can easily grab the URIs (and the credentials), and that’s the reason why HTTP GET is insecure. But this is not the whole truth:\u00a0As soon HTTP data are going over the wire, the data can be fetched from anyone in the chain of the transport, and it doesn’t matter which HTTP method is used.<\/p>\n
Some clever guys are running\u00a0TOR exit nodes and grab the whole traffic through a transparent proxy, and because they have access to the whole traffic, they are able to fetch credentials from these requests. As long as the data\u00a0are unprotected.<\/p>\n
To protect your data, you have two choices: Use HTTPS connections or encrypt the data by yourself (f.e. with JWE<\/a>). Manually encrypting won’t solve the problem of logging, but it can help to secure the data. But the preferred way is first one, because it solves all the problems of insecure data during their transport, and is really easy to implement. TLS \/ SSL is a layer between the TCP layer and the HTTP layer, and the whole traffic (the HTTP data) is\u00a0encrypted. This includes the URI,\u00a0only the target host is known to everyone involved of the transport<\/p>\n You shouldn’t use HTTP GET to transfer sensitive informations. The browser history is problematic, and the logs on the target server would contain the requested URIs. When developing a RESTful API you must bear this in mind.<\/p>\n","protected":false},"excerpt":{"rendered":" Yesterday Ren\u00e9\u00a0commented that submitting\u00a0username and password with HTTP GET is insecure, because they\u00a0are submitted in clear text over the wire as part of the URI. At the first moment, I did not give some thought about it,\u00a0because it is known … Weiterlesen