3 ms·

however it's still best to protect your secure data with un-predictable URLs. Please, please, no. This is terrible advice - do not rely on security by obscurit

by RyanZAG 14y ago

however it's still best to protect your secure data with un-predictable URLs. Please, please, no. This is terrible advice - do not rely on security by obscurity! This is not even obscure - anybody can open the network monitor in Chrome and get the URL. You should be doing exactly the opposite - publish your URLs and get researchers to investigate them. Give a bounty if they break it and you'll have tons of researchers all happily fixing your security for you! Do not obscure this stuff.

simonster 14y ago
I think the point is that each user's data should have its own URL, not that anyone should be able to get all the data from one URL. It doesn't matter if the user can get the URL; it points to their data, which they can get anyway. What matters is whether another website can get the URL and then pull the data out with a script tag, which is impossible if said website can't predict the URL. You could also accomplish this by encapsulating things in an object literal (as suggested on the page); requiring POST or a header or returning a non-JS Content-Type; loading an HTML page on the site and using window.postMessage to send the data only to trusted sites; and maybe more ways as well.
ricardobeat 14y ago
My interpretation is that you should have URLs tied to data that is out of reach of the attacker. Instead of http://myapp.com/me/contacts.json You'd have http://myapp.com/contacts/8df02390908dsf Where '8df02390908dsf' could be a hash computed from the user's data, but a simple unique ID would suffice - as long as it's stored in document.cookie/localStorage where the third-party website can't access it.
- RyanZAG 14y ago
  While it's great to have that as an extra layer against attacks, as with all security by obscurity, the problem is when you rely on that detail to act as your security. If that hash is computed from the user's data, in 5 years time when they need to expose new data to some new platform, they may mistakenly choose to use that hash. Now every attacker has access to that hash - and your security that relied on keeping the hash secret is now wide open. There are many other possibilities of losing secrecy of a public url hash like this also. The advice is still bad. Rather make your URL as open as possible and actually secure it for an attacker who happens to know it. If a user gets hacked and your response is 'well, nobody should have known the users ID!' then you're going to be looking pretty dumb.

by RyanZAG 14y ago

simonster 14y ago

I think the point is that each user's data should have its own URL, not that anyone should be able to get all the data from one URL. It doesn't matter if the user can get the URL; it points to their data, which they can get anyway. What matters is whether another website can get the URL and then pull the data out with a script tag, which is impossible if said website can't predict the URL. You could also accomplish this by encapsulating things in an object literal (as suggested on the page); requiring POST or a header or returning a non-JS Content-Type; loading an HTML page on the site and using window.postMessage to send the data only to trusted sites; and maybe more ways as well.

ricardobeat 14y ago

My interpretation is that you should have URLs tied to data that is out of reach of the attacker. Instead of http://myapp.com/me/contacts.json You'd have http://myapp.com/contacts/8df02390908dsf Where '8df02390908dsf' could be a hash computed from the user's data, but a simple unique ID would suffice - as long as it's stored in document.cookie/localStorage where the third-party website can't access it.

RyanZAG 14y ago
While it's great to have that as an extra layer against attacks, as with all security by obscurity, the problem is when you rely on that detail to act as your security. If that hash is computed from the user's data, in 5 years time when they need to expose new data to some new platform, they may mistakenly choose to use that hash. Now every attacker has access to that hash - and your security that relied on keeping the hash secret is now wide open. There are many other possibilities of losing secrecy of a public url hash like this also. The advice is still bad. Rather make your URL as open as possible and actually secure it for an attacker who happens to know it. If a user gets hacked and your response is 'well, nobody should have known the users ID!' then you're going to be looking pretty dumb.