From: Richard Conroy <richard.conroy@...>
Date: 2009-09-16T23:00:54+09:00
Subject: Re: Security considerations with REST calls

--0015175d07d2a116a30473b2538f
Content-Type: text/plain; charset=ISO-8859-1

On Tue, Sep 15, 2009 at 1:20 AM, Sj Tib <s_tibrewal@yahoo.com> wrote:

> Folks,
>
> I have joined a development group where developers have created a "REST"
> interface that passes username and password as parameters (with every
> call) though the call is made over https e.g.
> https://<baseurl>?user=<username>&pwd=<password>. It is not truly a REST
> interface as they have designed it to make all calls as POST (instead of
> using the other HTTP verbs like PUT/DELETE/GET).
>

Okay its unfortunate that your subject line mentions REST, as what you are
describing is not RESTful in the slightest. What you are describing is an ad
hoc
DIY protocol that tunnels over HTTP. None of the RESTful constraints are
observed.

This is basically the kind of pre-SOAP hacking that passed for programmatic
use of HTTP back in the nineties.


> 2. The REST API will be used by business partners for now but will be
> opened up for Apps on iPhone and other PDAs down the road. If every REST
> call is an https call won't there be significant processing overheads
> not only on the server side but also on the PDA client side?
>

I wouldn't be too concerned about the PDA aspect performance wise. But you
will take a hit by having all communication over HTTPS.


>
> 3. What is the best practice security model to be used with REST API
> when the interface will be opened up to the world for all kinds of apps
> to be built on top of it? (Not planning on OAuth as the data is not
> expected to be consumed by other website apps)
>

David has a better summary of the options, I won't rehash them here.

For programmatic use, sessionless HTTP authentication, either Basic or
Digest is preferred.

Basic is secure over HTTPS and is convenient. Digest may be a bit trickier
to support at the
server end, but it has the advantage that it offers secure authentication
over unsecure
connections.

I can't comment on the other programmatic authentication schemes, like OAuth
or OpenID. I am
not familiar enough with them.

regards,
Richard.

--0015175d07d2a116a30473b2538f--