3 ms·
Do you recommend signing requests?
by hundt 9y ago
Do you recommend signing requests?
- tptacek 9y agoNo. The reason to sign requests is the same as the reason to support OAuth: so that the owner of the account can sign a request and give it to someone else to execute --- delegated authentication. Signed requests are finer-grained than OAuth is, but OAuth is much simpler and is the industry standard at this point. Don't do either thing until you absolutely need it, but then, start with OAuth. Signed requests have burned a bunch of applications, more than have been burned by OAuth.
- hundt 9y agoThanks for the response! My thinking was that you might sign requests so that a request that was intercepted or inadvertently logged would not contain sufficient credentials to authorize arbitrary other requests for the indefinite future. It sounds like you do not consider that a significant enough issue to justify the complexity involved.
- tptacek 9y agoNo. You need to be securely using TLS anyways. Signed requests are hard to get right (Google "canonicalization vulnerabilities"). That's not a good tradeoff.
- dboreham 9y agoGood point: Credentials must not be logged. The easiest way to achieve this is to use HTTP basic auth for the token because web server infrastructure already knows not to log that, or a header OAuth2 style.
- dboreham 9y agoSigned requests were also invented when the transport connection was in the clear: if the request were not signed then it could be modified in transit by an attacker. These days all sessions are encrypted (SSL/TLS) and so this concern doesn't exist (or doesn't exist if you trust the transport).
- tptacek 9y agoThe AWS API runs over TLS, and uses signed requests.
- dboreham 9y agoPerhaps because it was originally designed for use without TLS? Request signing was pretty much ubiquitous 10 years ago.
- Promarged 9y agoI'm not from Amazon but I'd guess they want to protect the request from being replayed inside their own systems.
- sloxy 9y agomore likely it's so they don't have to have a more convoluted process where they call out to requesting service to verify RQ & all which that entails (on both sides).