Variables in headers : Avoid secrets in the payload

[baubakg]

The json payload is quite dangerous regarding secrets. We need to find a way to avoid passing secrets dirctly in the payload.

We can send secrets in the headers. When received they are available to the calls as values.

We also forbid the showing of these variables by chance. I.e. if the result is equal to a header we do not show it.

Rules: Header should have the prefix "IBS-"

Example:

1. We call http://localhost:8080/call
2. We pass headers IBS-USERNAME, IBS-password
3. Payload

{
    "callContent": {
        "LOIGIN": {
            "class": "<package name>.<class Name>",
            "method": "<method name>",
            "args": ["IBS-USERNAME","IBS-password"]
        }
    }
}

In the call above the callContent payload will not have the secrets directly in the payload. When dealig with the payload we directly fetch the secrets from the headers.

If the result contains the secrets, we will either:

• Throw and exception/forbidden return value
• Obfuscate the result

Exceptions:
ConfigException if the header variable is also the title of a callContent
ConfigException if the header variable is not present