Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention (parameter &) to perform your query:


Let's suppose that this is the query to retrieve information related to a specific product in our repository. My point in that somebody could see this query format in a Web page and modify it to retrieve another product, even when it is not authorized to access it. This scenario can shows up when those OData Services are consumed using a Client Side approach like JQuery.

Does that make sense?

share|improve this question

The key to Insecure Direct Object Reference is the insecure bit. While it's not always a great idea to use direct object references sometimes you just have to because thats the schema of the data and you can only use the schema of the data. OData is one of those cases. So here you are stuck with managing the insecure bit, and OData doesn't have any authentication or authorization mechanism built in. You have to build in the auth schemes.

So to answer your question, OData is only insecure as long as you haven't set up authn or authz for the particular objects.

share|improve this answer
Thanks for the complete answer.I was idealizing a Web scenario where you have a Web page and via Jquery you retrieve the customer information.So anybody could see the source code and be able to see the service EndPoint and parameters and use an external tool to start the Http Negotiation. – Michael Hidalgo Oct 23 '11 at 17:57
The ability to see (or not see) source code on the user end should never be considered a security measure. – Steve Oct 23 '11 at 18:22

I think this is true for all URLs, whether they use the OData protocol or just display a web page:

The authorisation has to be done at the time the request is processed. For example you cannot access this question unless you have enough reputation:

Keeping URLs secret for more than a couple of hours does not work, even when they are not guessable, because many people use browser extensions that report every visited URL to the major search engines.

share|improve this answer
Yes that is true.In this case the authorization should be done in the back end right?. My question was related to find a way to encrypt those values before show it in the URL.Something similar to the mechanism used to encrypt the post or get query string values.I mean finding a standard way to to that. – Michael Hidalgo Oct 23 '11 at 17:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.