HTTP Verb tempering using MITM attack possibilities and prevention in rest api.

If an application URL is dependent only on http method to determine it's action, how can we reduce impact of tempering by someone using MITM techniques?

For example, GET /xyz/ displays the show page of entity to requester while DELETE xyz/ can delete the page. The concern is, if an admin user request for show page and someone in the middle changes method to Delete, page will get deleted.

Both requests needs same authentication token so the attacker, sitting in the middle, will only have to change method and entity will get deleted.

How can we reduce possibilities of such scenarios? Will a confirmation message be enough or some other measures should be applied?

  • Depending on the frequency the something is deleted, a confirmation message could make sense. But that may impact the work efficiency. Generally, correctly implemented authentication, authorization and HTTPS does the trick against MITM attacks.
    – SaAtomic
    Jul 27 '17 at 9:30

If you fear a man in the middle attack you should protect against it by using HTTPS instead of HTTP. HTTPS is exactly designed to protect the data transfer against modifications by a man in the middle.

Using some kind of simple confirmation message instead will not help since a man in the middle attacker can also reply to this message or change the response presented to the client. While one might probably think of a more complex system of signed messages to deal with this properly, implementing this by yourself is much harder to get it right than just enabling HTTPS. Therefore using HTTPS should be the preferred way to protect against MITM.

  • Thanks for the answer. Well...HTTPs is already in place. Is this sufficient? No extra layer required?
    – Sum
    Jun 27 '17 at 8:29
  • @Sum: if done properly HTTPS is enough. Properly means at least to correctly check the certificate of the server in the client to detect potential man in the middle attacks and to use state-of-the art ciphers and certificates. Jun 27 '17 at 8:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.