2

Note: Original question asked at https://stackoverflow.com/questions/24012390/is-this-token-based-web-service-secure but here seems to be the right place for it.


The company that I current work for has an internal application, it provides some RESTful (sort of, just a collection of URLs) APIs. To access the APIs outside of the company network would require an HTTPS connection and a token (if accessing within the company network, no restriction is applied).

To call an API, the caller (another internal application or employee) will need to create a token by something like this:

  1. Sort the URL parameters
  2. Hash part of the sorted URL with a salt (global constant)
  3. Use a substring of the hash as the token
  4. Append that token as a parameter in the URL and send the request

The server will perform the same algorithm on the original URL, if the token comes out the same, the request is considered authenticated.

I am no security expert, but this feels wrong to me, but I can't fully explain why. So I'm asking for help from the security experts, what are problems you see here? Or am I being too paranoid?

Thanks.

4

This provides zero authentication of the individual calling or the authenticity of the original call making it through to the server. This may have been intended as a way to verify the request had not been altered, but unless it is actually forming a signature rather than a hash, then this provides no security.

If the hash is signed, it becomes a secure way to authenticate the parameters of the request are authentic as the hash allows verifying that parameters have not changed and the signature prevents an attacker from generating their own hash to match false parameters.

  • Thanks for pointing out the signature concept. Unfortunately it's just a way to stop outsiders from calling the APIs (and some of them are critical services, e.g. delete data), and the hash is simply a substring of an MD5 hash created using the URL and short salt string. – user47721 Jun 4 '14 at 10:29
0

You are correct. This is poor security. It relies on a secret process rather than a secret key. Any security that relies on keeping the process secret is inherently insecure

  • 1
    Thanks, this was what I thought as well, and if the process is compromised, there is no way to fix it without changing the source and building the application again, and that will break all existing users. Compare to a real token based system where you would just invalidate the compromised token. – user47721 Jun 4 '14 at 10:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy