14

According to Instagram's Documents, we send an access-token through a GET request over HTTPS. Isn't this considered insecure? Because I've read that you shouldn't even send passwords over a GET request.

For /media/media-id (the first example):

https://api.instagram.com/v1/media/{media-id}?access_token=ACCESS-TOKEN
Improve this question

1 Answer 1

Reset to default
21

As explained here, sensitive data in the URL query part (such as a secret API token) is primarily an issue if the URL is accessed directly in the browser and therefore visible in the URL bar as well as stored in the browser history.

But API requests are usually performed in the background of an app or via a background AJAX request and therefore you're much less likely to run into a situation where the plain API request URL is presented to a user. Therefore the dangers of sensitive data in the URL are negligible for an API.

Also note that over HTTPS the full HTTP request is encrypted, including the query part. Only the hostname (api.instagram.com) would be exposed to a MITM as a side effect of SNI.

Improve this answer
4
  • 3
    Great answer! I would add that if you have a proxy that does TLS-interception, you will risk having your access token recorded in logs on it. But since you need to explicitly trust a such a proxy for it to be able to read your traffic, I would say it is a minor issue.
    – Anders
    Commented May 2, 2017 at 7:29
  • What if I HAVE TO send the api token in url? is it a big issue?
    – Ramesh Pareek
    Commented Feb 14, 2018 at 12:33
  • @RameshPareek If the API token is visible in the user's URL bar and not just a one-shot token, then you might want to avoid it for the reasons I gave in this answer. If the token is just part of a background request, you're most likely fine.
    – Arminius
    Commented Feb 14, 2018 at 13:21
  • 2
    Just to add to @Anders comment on logging of the URL (and therefore token), an environment that needs to comply with PCI or HIPAA rules may not consider this logging a minor issue. It definitely depends on the specific scenario, but I think if the token allowed one to access PHI (for example), the logging of it would be a problem.
    – Jason Capriotti
    Commented Apr 23, 2019 at 16:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .