1

I have noticed that my private Google Drive resources, for example, although it is impossible to "guess" their hash-key and get it (eg tbEB6fQTqQcFAoRBXYvnpNVq9F3PUr_cs), however the server requires authentication to access the resource.

On the other hand, in ICloud I saw that while there is an "external" link that represents each resource, it is private, but the real address (by which the client-side goes the resource) is without any authentication .

I think that makes sense, that there is no way for an attacker to obtain the key in Query String, because it is encryped by SSL.

The question is whether there is any fear of it and therefore to implement validation as Google does. I'm talking about an application where resources are not exposed in any way to an unauthentication user.

marked as duplicate by Community Nov 8 '17 at 19:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Sorry - are you suggesting iCloud will return a private document to an unauthenticated user if they posses the correct URL? Additionally you use the phrase hash-key. Resource IDs are very rarely hashes because the content and metadata can change. Its normally a randomly generated ID. – Hector Nov 8 '17 at 14:18
  • @Hector, a. this is reality, you can check. the url starts with "cvws.icloud-content.com/B". b. you right. i dot now how call random resource-id. – dovid Nov 8 '17 at 14:29
  • 1
  • 1
    That URL contains numerous query parameters which if modified or removed lead to a bad request. It isn't just using the id. I expect one (probably o) is an authentication token. e to me looks likely to be a unix timestamp meaning that link will likely expire in a few minutes (11/08/2017 @ 3:58pm UTC). I also expect s is a signature so the link parameters cannot be modified. – Hector Nov 8 '17 at 15:54
  • 1
    @lomed - Yep - Loading the link now results in 410 "Gone" – Hector Nov 8 '17 at 15:59
1

As pointed out in the comments by @Sjoerd simply using a URL to protect a resource in theory can be secure but comes with several potential problems. If this is your question then it is a duplicate of Is random URL token secure enough for file attachments and other user content?.

As per my comments it appears iCloud does not simply use a URL. The link provided contained several query parameters including a session token, (relatively short) expiry and signature.

Not the answer you're looking for? Browse other questions tagged or ask your own question.