5 ms·
Even if you use HTTPS, aren't you vulnerable to lazy devs who put the password in the URL? If I use https://username:password@example.com/ https://username:pas
by redblacktree 14y ago
Even if you use HTTPS, aren't you vulnerable to lazy devs who put the password in the URL?
If I use https://username:password@example.com/ https://username:password@example.com/, doesn't that URL show up in server logs all over the internet?
- tptacek 14y agoDon't ever use passwords for API authentication. It's an API, not a browser. The users of an API are other programs, not people. Issue single-purpose random credentials. I didn't think this was something I had to point out about API authentication, but apparently it is.
- CodeMage 14y agoI have a stupid question: how do you do this with HTTP Basic auth?
- tptacek 14y agoGenerate random long passwords.
- redblacktree 14y agoBy "don't ever use passwords" you mean, "don't let users set their own passwords," right? Obviously, you're still using a password if you use HTTP Basic Auth.
- deleted 14y ago[deleted]
- jimktrains2 14y agoNo. The UA strips those and puts them in an Auth header.
- lhazlewood 14y agoDepends on the UA (curl?)
- jimktrains2 14y agoOK, so it'll either add an auth header or not know what to do and refuse to do anything. Either way the password is not sent in the request url
- jimktrains2 14y agoActually, I mused have screwed up last night. The version of curl I have does support it and does put it into the Auth header. % curl --trace-ascii /dev/stdout http://jimktrains:password@news.ycombinator.com == Info: About to connect() to news.ycombinator.com port 80 (#0) == Info: Trying 184.172.10.74... == Info: connected == Info: Server auth using Basic with user 'jimktrains' => Send header, 223 bytes (0xdf) 0000: GET / HTTP/1.1 0010: Authorization: Basic amlta3RyYWluczpwYXNzd29yZA== ....... Some UAs however, do just drop it. Like IE (http://support.microsoft.com/kb/834489 http://support.microsoft.com/kb/834489)
- jes5199 14y agoEven curl does the right thing for basic auth
- lhazlewood 14y agoYou shouldn't ever use username/password pairs for API authentication. If the user ever changed their password, then their API calls would immediately fail! This is one of many benefits of using multiple (revokable) API Keys.
- olivier1664 14y agoPlease correct me if I'm wrong. HTTPS will encrypt the URL, but the DNS lookup is in clear. So the "username:password@example.com" part will be sniffable/loggable. http://stackoverflow.com/questions/499591/are-https-urls-encrypted http://stackoverflow.com/questions/499591/are-https-urls-enc...
- jewel 14y agoThat's incorrect. The URI library will parse the URL into a hostname, username, and password. Only the hostname is sent to the DNS server. The username and password are sent in the "Authorization" HTTP header, which will be encrypted.