I am currently developing against a RESTful API that seemingly has a rather weird auth flow. I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID).
Now, whenever I want to call the API, I have to do the following:
- Create JSON request body
- md5-Hash of (API-URL, Request, ID, Secret)
- Set ID as header field "UserId" of request.
- Set generated hash as "Authorization" header in the API call.
I assume that the receiver pretty much does the same hashing (and knows the secret of my ID) and compares the results.
However I think this is really wonky as
- The JSON request body becomes case sensitive due to the hashing. If I add one space, the hash is different and auth fails.
- They "roll their own" security related things it seems.
These issues are rather broad though. I would like to know what flaws are in this implementation that I am currently not seing?