Disclosure - I'm not a security professional - but I have a security issue (I think) I need to articulate to a client.

We have a partner organisation that has built an API for a mobile app we're building. Rather than use oAuth for the facebook login - we're required to POST a user's facebook ID to the API endpoint, via HTTPS, with a static API key in the header.

They regard this as sufficiently secure to grant access to that user's account. But it smells fishy to me.


POST to https://example.com/user/auth?id=12345678 with header X-Auth-APIKEY = TOPSECRET

Obviously, I see an issue where if the key is compromised, it's screwed (because it's hard-coded into the our app) - but is there anything else I'm missing?

Extra kudos for translating any potential threat into language a marketing manager could understand :)

  • You lost me and probably every actual security professional at "... and facebook id" – Shadur Jan 8 '14 at 14:04

It'll work, but its not ideal. https will encrypt the URL and headers, so theoretically its alright.

As you correctly pointed out, if the APIKEY is exposed you're screwed. The fact that there is two different parties involved in production that possibly know the password would also be a worry.

It might be a good idea also to ensure that APIKEY is sufficiently strong so the service isn't susceptible to brute force attacks.

Edit: As people have correctly pointed out, the owner of the app can use a packet sniffing software to see the API key, something which I overlooked while thinking about the external threat as opposed to the apps owner.. silly me.

  • APIKEY will be exposed at some point. Fiddler will find it for example, so any techie end-user will be able to find out what it is. – Ben Jan 8 '14 at 17:06

If it is server-to-server and you control the server that might be acceptable. But if this API is used from the client, No this is not OK.

HTTPS will secure the secret from third-party eves-droppers but not from the user himself. Since the user controls the computer, they decide what certificates are trusted, and can install their own man-in-the-middle. There is even a free tool which does this known as Fiddler - used primarily for debugging purposes it can install an HTTPS certificate into the certificate store and use it to MITM all communications.

Therefore it is trivial for any computer user to find out the APIKEY, and then every other user is pwned. Not Good.

For marketing: "This would allow any technical user to discover the APIKEY and they could then access the data of every user."

  • 1
    +1. Or it might be possible to reverse engineer the app to find the API key in the case of a MITM with Fiddler not being possible due to certificate trust chain or pinning. – SilverlightFox Jan 9 '14 at 10:01
  • @SilverlightFox, indeed, any good debugger could capture the data just before it was sent down to the server. – Ben Jan 9 '14 at 12:41
  • Even mentioning to Marketing that a potential leak will bring us in the news and we may not have any more customers in the future – pal4life Feb 8 '17 at 22:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.