1

We have a few in house endpoint that we'd like to keep in house and be used by developers who have access to different servers. We were going to generate a secret key, save the key on the respective servers, and then add it to the cURL request in the Authorization:Bearer header such as:

curl -H "Authorization:Bearer some-token" https://www.some-endpoint.com

to be then verified when the endpoint was hit.

After doing some googling around, I noticed that Stripe uses:

curl https://api.stripe.com/v1/transfers -u sk_some_secret_key -d amount=some_amount -d currency=usd -d destination=some_account

so that the key isn't sent as part of the header. From a security standpoint, is one method more secure than the other?

2 Answers 2

2

Both requests are actually quite similar. In either case, the authentication credentials end up in the HTTP request header. You can see this by using the --verbose option with curl.

For the first case:

curl --verbose -H "Authorization:Bearer some-token" https://www.somesite.com/

From the verbose output, you can see that curl includes a header with the name Authorization and the value Bearer some-token in the request header:

> GET / HTTP/1.1
> Host: www.somesite.com
> User-Agent: curl/7.68.0
> Accept: */*
> Authorization:Bearer some-token

The second case uses HTTP Basic Authentication:

curl --verbose https://api.stripe.com/v1/transfers -u sk_some_secret_key -d amount=some_amount -d currency=usd -d destination=some_account

curl prompts for the password to use for HTTP Basic Authentication. Then, from the verbose output, you can see that curl includes a header with the name authorization and the value Basic c2tfc29tZV9zZWNyZXRfa2V5OnRlc3Q= in the request header:

> POST /v1/transfers HTTP/2
> Host: api.stripe.com
> authorization: Basic c2tfc29tZV9zZWNyZXRfa2V5OnRlc3Q=
> user-agent: curl/7.68.0
> accept: */*
> content-length: 56
> content-type: application/x-www-form-urlencoded

c2tfc29tZV9zZWNyZXRfa2V5OnRlc3Q= is the encoded username and password used for HTTP Basic Authentication.

1

From the security standpoint these ways are about the same:

  • in both cases the secret is protected by HTTPS, i.e. no matter of HTTP header or body
  • in both cases the secret is visible on the command line, i.e. can be retrieved by an attacker from a leaked script or similar

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.