0

I am using set of REST APIs build using Java Spring. I need to pass an encrypted value from client to a REST service. The client invokes a GET request.

My question is how secure and efficient it is to pass the encrypted value (as a string) in the query string. If it not that secure , what are the alternatives I have ?

4
  • Is the client a browser?
    – ndrix
    Jan 5, 2017 at 4:45
  • Hi, ndrix. No client is not a browser. It is another Java application(Spring). Jan 5, 2017 at 5:58
  • Are you worried about your encryption being broken or are you worried about something else?
    – Limit
    Jan 5, 2017 at 7:05
  • Yes one thing is encryption is broken. Other one is how efficient it is to send an encrypted string in a query string in terms of performance ? Jan 5, 2017 at 9:09

1 Answer 1

1

Assuming that the risk could be a MiTM attack between your Spring client and the REST service, it doesn't necessary matter whether it's in a query string or POST body. A query string would get cached (in a browser, proxy server, ...) which could lead to disclosure; but all in all I would encourage using end to end encryption.

If you Spring client ensures that it's talking to the right REST service (cert validation, pinning, ...) - then you can send "secrets" over that connection with a reasonable assurance of confidentiality and integrity.

Additionally, I don't know what your "encrypted" value is, if it's encrypted with a shared key, then someone could spend enough resources/time to reverse engineer it and get the secret. If you're sending secret data; try to stay away from custom implementations; an end-to-end SSL/TLS tunnel has been proven very robust.

2
  • Thanks for the update @ndrix ! What I am sending in query string is an encrypted JWT. I am using set of Micro services, hence it is bit difficult to maintain certificates upon rapid provisioning and de-provisioning of services. i am using a shared key in this instance. Jan 5, 2017 at 21:46
  • Doing your own implementation will always give you more overhead. Is your encrypted token signed? Do you encrypt and then sign or vice versa? You could pin to either intermediate CA or pin certificate sets; this way - you eliminate bad messages quicker without any logic. Performance increase too.
    – ndrix
    Jan 11, 2017 at 6:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .