Let's say I have an address for an API like this:


If accessed, a JSON will appear like this:


The result defaults will be displaying the entire data if a post has no parameters. If you use post "ID" and the ID parameter value is one of the existing data in the API, it will only display objects from the data selected based on the ID. The API can be accessed by anyone. API needs to be accessed using token parameters to secure the data.

Let's say I add a token parameter to be able to access data like this:


if (post_param[token]==yourtoken) {
  // Displaying JSON

so if you want to open the API, you need to add a token parameter.

Is simple security like this worth using? what vulnerabilities will arise if I use this? is there a better way than this?


1 Answer 1


There are some things to take into consideration:

  1. Using an integer that increments to 1 for every new user is predictable, so IDOR vulnerabilities arise;
  2. Tokens should be of a high randomness and must have a lease time. Consider using JWT for example;
  3. Transfer the data using encryption.

If it is just some kind of experiment, consider hiding your API against nginx balancer with authentication. It is pretty straight-forward to configure basic authentication. In more advanced scenario you may want to use client-side certificates. Check this article for the implementation.

The result defaults will be displaying the entire data if a post has no parameters

Also consider removing functionality for displaying the entire data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .