Is this token based web service secure?

Question

Note: Original question asked at https://stackoverflow.com/questions/24012390/is-this-token-based-web-service-secure but here seems to be the right place for it.

---

The company that I current work for has an internal application, it provides some RESTful (sort of, just a collection of URLs) APIs. To access the APIs outside of the company network would require an HTTPS connection and a token (if accessing within the company network, no restriction is applied).

To call an API, the caller (another internal application or employee) will need to create a token by something like this:

1. Sort the URL parameters
2. Hash part of the sorted URL with a salt (global constant)
3. Use a substring of the hash as the token
4. Append that token as a parameter in the URL and send the request

The server will perform the same algorithm on the original URL, if the token comes out the same, the request is considered authenticated.

I am no security expert, but this feels wrong to me, but I can't fully explain why. So I'm asking for help from the security experts, what are problems you see here? Or am I being too paranoid?

Thanks.

Answer 1

This provides zero authentication of the individual calling or the authenticity of the original call making it through to the server. This may have been intended as a way to verify the request had not been altered, but unless it is actually forming a signature rather than a hash, then this provides no security.

If the hash is signed, it becomes a secure way to authenticate the parameters of the request are authentic as the hash allows verifying that parameters have not changed and the signature prevents an attacker from generating their own hash to match false parameters.

Answer 2

You are correct. This is poor security. It relies on a secret process rather than a secret key. Any security that relies on keeping the process secret is inherently insecure