0

I just encountered API which I find pretty vulnerable. Could you clarify if my concerns are wrong?

1)For retrieving user data, API KEY, which is unique for every user i used. This api key is stored in rest url. For example, to request something, request is build /something?api_key=dsfdsf34r3wrwfdew3r3rfw3. Api key is constant for the lifetime of user. It can be retrieved after login. Is it safe to get user data using this key? It seems to me, that if I know some other person's api_key, I can get everything I want about him. And if I make an app, that works with this Api, I can just store these keys and use them anytime I want for whatever purpouses I want. Are these concerns legitimate? Are there other ways to exploit it?

2)Login is just plain text form with fields email and password. I loggined successfully using postman and simple form. Is this form of login is considered safe? How can it be improved?

1 Answer 1

2

It seems to me, that if I know some other person's api_key, I can get everything I want about him.

The same if you have this person's password. Am I wrong?

And if I make an app, that works with this Api, I can just store these keys and use them anytime I want for whatever purpouses I want.

Yes, you can use the token to do anything that the user have granted to you. For this reason, do not grant permissions to any app on the internet, like you do not give your password to untrusted people.

Are there other ways to exploit it?

Depends on a lot of factors. Using open redirectors to steal victim's token, brute forcing the API tokens (a decent API would not permit brute force), etc.

Is this form of login is considered safe?

If the page is loaded over HTTPS, the form posts the login and password data to another HTTPS page, and the page does not have any XSS or mixed content issues, so is secure "enough".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .