I own a set of REST APIs and some of them don't require users to be authenticated.
Example could be: api/items/index of an e-commerce".

Currently, I use Cookie-based tokens from my application, but only for secured API like edition of an item: api/items/2/edit for instance.

What could prevent anybody to track from its own application the corresponding direct URL (let's say https://myAppDomain/api/items/index and got all the items as a pure list of JSON?
Indeed, it could be lead to phishing...

  • 2
    A trusted client can by only run on a trusted system. – CodesInChaos Mar 12 '14 at 10:39
  • @CodesInChaos Let's call it a "semi-trusted" :) I was thinking about a kind of shared secret key.. no? – Mik378 Mar 12 '14 at 10:41
  • 1
    I don't see what phishing has to do with anything, but I also don't understand the question. You're trying to avoid users from downloading the index of items, but you still need it to be available to your application (that the user will run) without authentication? – David Mar 13 '14 at 7:45
  • @David Yes, your interpretation of my question is correct. But I guess the answer now.. :) as any external client can never be trusted, it would be strictly impossible to ensure at 100% that the call to https://myAppDomain/api/items/index always comes from my official client webapp (javascript client), even with a shared key between official server side and official client side, since on client side, any malicious user could steal it. Am I right? – Mik378 Mar 13 '14 at 11:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.