0

I am building a web app that needs to be secure. Is there any security advantage to hiding path parameters? I am using Angular (I don't know if this is important).

What I mean by hiding path parameters is instead of having a URL that reads

https//yourApp/user/<user_id here>

to have one that reads

https//yourApp/user

but behind the scenes you are processing the request using the user id.

  • OK, that is part of the path that you wish to hide. – mat Jul 24 at 11:54
6

Is there any security advantage of hiding route parameters

Yes, if they contain anything potentially sensitive.

If you pass information as URL params, either in the query string (?key=value) or as part of the path (/someValue) then these are cached in various places in the browser and host machine.

Most restful services expect you to pass some form of identifier in the URL however you must consider the impact should that identifier be exposed.

For example imagine you have an endpoint that accepts username as a url param (domain.com/users/username) and your username can also be an email address. You essentially expose the users email address for that service to place you do not control (browser history etc).

You need to make the call on how sensitive each data point is and decide if you are happy exposing it (weight up risk).

General rule for me is, if that information can be used to leverage anything over the user or as a stepping stone to expose further info, don't expose it in the URL.

  • 1
    And for that matter on any intermediaries such a proxy servers etc, granted they could also spy on any non encrypted payload of the request too but you can be pretty sure that even well behaved ones that refrain from doing that are probably going to log the URL. While many will refrain from capturing obvious URL parameters (Anything after ? or #) the example posted implies that mod_rewrite might be being used in which case any proxy will see it as simply being part of the path and will log it in full. – MttJocy Jul 24 at 11:16
  • If the input validation of the parameter (?key=value) is not done properly, it may lead to increase of surface area for another attack: "command execution". For example take ?user=value, the attacker may inject server/SQL commands in the place of value. – nocut Aug 30 at 7:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.