I just encountered API which I find pretty vulnerable. Could you clarify if my concerns are wrong?
1)For retrieving user data, API KEY, which is unique for every user i used. This api key is stored in rest url. For example, to request something, request is build /something?api_key=dsfdsf34r3wrwfdew3r3rfw3
. Api key is constant for the lifetime of user. It can be retrieved after login. Is it safe to get user data using this key? It seems to me, that if I know some other person's api_key, I can get everything I want about him. And if I make an app, that works with this Api, I can just store these keys and use them anytime I want for whatever purpouses I want. Are these concerns legitimate? Are there other ways to exploit it?
2)Login is just plain text form with fields email
and password
. I loggined successfully using postman and simple form. Is this form of login is considered safe? How can it be improved?