0

I'm trying to integrate with my host using their REST webservices.

However, the authentication for the webservice only requires two things:

  • An API token which I can retreive from their portal once
  • My username to access their portal

Both need to be sent in the headers, under the names 'ApiKey' and 'PortalUsername'. It must be sent over HTTPS.

How safe is this really? I'm not too technical but I do know a few things about webservices and authentication. HTTPS is not the solution to protect against every kind of interception. I once integrated with some other webservice and they required the API key to be hashed and digested via some path, that seemed safer to me.

I'm eager to learn more on this subject and know wether I can safely use this webservice (with access to quite sensitive information), or not based on how they setup the authentication.

Improve this question
2
  • It's fine. Stop worrying and build your app :) – paj28 Aug 11 '16 at 13:27
  • Thanks :) I'm just interested in learning more about this since I see so many different authentication methods for all webservices available and I don't know what's safe / outdated and what not. – Marcel Aug 11 '16 at 13:51
1

Everything that goes through HTTPS is enough as long they use a certificate trusted by your browser. This means it was forged by 3rd-party acknowledged authority of certification.

If they use their own certificate. You may reconsider that statement.

Improve this answer
2
  • Thanks! They use Comodo certificate, which is trusted by the browser. No self-signed certificate if that's what you mean. – Marcel Aug 11 '16 at 13:52
  • @user2897757 Yes it is, if you use their rest services with other non web-application languages too (c#/Java) don't forget to do the proper set-up in order to allow only their certificate and not a self-signed. – Walfrat Aug 11 '16 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.