1

I'm planning to build an API for my project, and thinking about authentication. What is the risk of not having any authentication?

Could someone 'crawl' all of my post/get routes? And how would they know what data/arguments they need to send in order to make bad use of any of the API functions?

For example, some of my API functions would be: retrieving user accounts details, making service reservations, retrieving those reservations details, etc.

  • This is way too broad. We would need to know all the details about your API, exactly what it can do, etc. Otherwise there is no way to tell how important authentication is. – forest Sep 16 '18 at 1:07
  • I updated the question. The API can definitely access sensitive data. What I’m wondering is, how could someone know exactly the URL of my exposed post methods? Including the body/data parameters that the API function is expecting to receive. – Jk33 Sep 16 '18 at 2:03
3

"Good security practice" is to follow Kerckhoffs' Principle:

One ought to design systems under the assumption that the enemy will immediately gain full familiarity with them.

Not following Kerckhoffs' principle means you're doing security through obscurity. A quick google will show you what the community thinks of that.

Your question:

And how would they know what data/arguments they need to send in order to make bad use of any of the API functions?

Maybe through a brute-force crawler. Maybe they somehow get access to your WSDL or Swagger files containing the full description of the API. Maybe they get access to your client app or SDK and reverse-engineer the API. Maybe they sniff traffic and observe people using your API. Maybe other methods.


It's clearly up to you whether adding auth is within the scope of your project, but having APIs that serve or accept sensitive data with no auth is very much bad practice. Better yet is to have access control on top of auth to control who can view / set which data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.