API Key should not be passed as a parameter

[philippeluickx]

Adding keys in URL is not a safe practice. It stays in (browser) history and call logs. (It is secured though: https://groups.google.com/forum/#!forum/api-craft)
Better option is to pass the key in the header of the requests, e.g. authentication header.

edit: found that URLs are secure, but still best practice to not include sensitive data in URLs

Edited by bajiat:

Usernames, passwords, session tokens, and API keys should not appear in the URL, as this can be captured in web server logs, which makes them intrinsically valuable.
NOT OK:
https://example.com/controller/action?apiKey=a53f435643de32 (API Key in URL)
Source: https://www.owasp.org/index.php/REST_Security_Cheat_Sheet

Definition of done:

• Remove instruction for passing API key in URL

[bajiat]

@philippeluickx Where and what kind of change are you proposing/expecting?

[philippeluickx]

@bajiat Common practice is to use HTTP headers for authentication. Changes should be minimal to implement this.
E.g. http://code.tutsplus.com/tutorials/http-headers-for-dummies--net-8039

[bajiat]

@philippeluickx Still unclear about the impact about this issue. Where in the UI does this occur?

[philippeluickx]

Impact would be how we pass information to the developer (user) of an API. Otherwise no impact in UI.
The effect is mainly in how calls are made.

[frenchbread]

This approach is implemented here.

[philippeluickx]

@frenchbread so do we have multiple options (and parameter is the default) or is this something new?

[frenchbread]

@philippeluickx Did not really got your question.

Meteor's HTTP.GET method takes options such as headers, parameters etc. Documented here. So we could either pass credentials as headers or as a parameters.

[philippeluickx]

Ok, right. So you basically mean that if we want to implement using Headers instead of parameters, this is pretty standard behaviour?

[frenchbread]

@philippeluickx Yep.

[jykae]

@philippeluickx If we want really be secure about this we could set "pass API key header" as default, otherwise Umbrella accepts both anyway. What you think?

[philippeluickx]

@jykae Sounds good to me. Default to the more safe behavior, but leave the other options open.