5 ms·
(Not the GP) Yes, when done right, but it's iffy. For example, the article includes URLs like "/people/123". The security of having a leading slash in these de
by raquo 7y ago
(Not the GP) Yes, when done right, but it's iffy.
For example, the article includes URLs like "/people/123". The security of having a leading slash in these depends on API base URL.
"https://api.hotstartup.com/v1" https://api.hotstartup.com/v1" – safe
"https://api.hotstartup.com" https://api.hotstartup.com" – unsafe with ".evil.com/people/123"
I wouldn't really call this particular scenario a security issue, but allowing such things is a bad habit that will eventually bite. It's like not HTML-encoding values like usernames that you "know" are safe (but you know are not HTML-encoded).
- nertzy 7y agoYes, this is why developers should use URI-building libraries instead of direct string manipulation to modify URIs. If I visit an HTML page with a link to “.evil.com/people/123” and click on it, the user agent won’t append “.evil.com” to the hostname. You’d instead get something like “https://api.hotstartup.com/.evil.com/people/123” https://api.hotstartup.com/.evil.com/people/123” which would be safe (if not broken).