asked on

authenticating a REST call when there is already a session

Hi Experts,

I'm interested in hearing my options when I have a REST API that any authenticated individual can call. Basically, there's an ID that's reused across multiple REST calls and anyone looking at the URL can do injection attacks on it (if they are authenticated of course).

Any options or best-practices that exist for this?

Many thanks,
Mike

Dave Baldwin

I'm not sure I understand the question. Anyone who authenticates looks like a legitimate user. Besides the normal user logouts and session timeouts, what are you looking for?

thready

ASKER

The unique ID used in the REST call is one used during that session, assigned by the server with a previous get from the client. The rest API can be tampered with if someone sniffs URLs coming from a legitimate user (from another badly behaving legitimate user who's logged in.) Since anyone can see that unique ID, another user can make a REST call with it with bad data and it would break the behavior of the API... please let be know if this is still not so clear...
Thanks!
Mike

thready

ASKER

Basically, URLs are not encrypted over HTTPS, so anyone can see that ID. presumably, all you would need to do to break this REST API would be to use it maliciously... by logging in and using someone else's ID... from their own API call...

ASKER CERTIFIED SOLUTION

Dave Baldwin

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

thready

ASKER

Where does the rfc say that only the server name is sent in the clear? I can't find that anywhere...

Dave Baldwin

Note "a connection to the server".

2.1. Connection Initiation

The agent acting as the HTTP client should also act as the TLS
client. It should initiate a connection to the server on the
appropriate port and then send the TLS ClientHello to begin the TLS
handshake. When the TLS handshake has finished. The client may then
initiate the first HTTP request. All HTTP data MUST be sent as TLS
"application data". Normal HTTP behavior, including retained
connections should be followed.

That is also what I see in Fiddler.

thready

ASKER

Kick-ass answer. Thanks a lot! awesome.

Dave Baldwin

You're welcome, thanks for the points.