Disclosure - I'm not a security professional - but I have a security issue (I think) I need to articulate to a client.
We have a partner organisation that has built an API for a mobile app we're building. Rather than use oAuth for the facebook login - we're required to POST a user's facebook ID to the API endpoint, via HTTPS, with a static API key in the header.
They regard this as sufficiently secure to grant access to that user's account. But it smells fishy to me.
POST to https://example.com/user/auth?id=12345678 with header X-Auth-APIKEY = TOPSECRET
Obviously, I see an issue where if the key is compromised, it's screwed (because it's hard-coded into the our app) - but is there anything else I'm missing?
Extra kudos for translating any potential threat into language a marketing manager could understand :)