CODEWITHSUNDEEP
apirest
Qasim Javaid Khan
Qasim Javaid Khan

Reputation: 660

REST Api an invitation to hackers for injection?

I am new to REST APIs, I am actually not looking for any workarounds, I just need to clear my concept because I know I am missing some very important information which can easily solve my problem.

For E.g I made a small website, let's say using angular.js, where I will list some information or some items.
Consider it as an open website for now, everyone is getting same list. Anyone can come to the page and see the list of items. Simple. Lets say the URL to this list is

https://www.example.com/api/list/v1

Result returned

    1. abc
    2. cde
    3. efg
    4. hij

Perfect!

Now my site got traffic, and I decided to implement user thing on my website, so that every user can only see his own information.

So I changed the rest api url to this:

https://www.example.com/api/list/v1/12345 where 12345 is userid.

The user with the user id came on the website, logged in, and browsed the list, by chance he went to the source of the page, and he found the url to list information. He copied the url and started to use different user id's, he might get lucky any time.

I am not talking about implementing any type of security up til now, there must be several ways to secure it. My main concern is that isn't it a large security hole, or we can call it an invitation, for injections?

So I just want to clear my understanding, where I am wrong?

Thanks

Upvotes: 0

Views: 440

Answers (1)

Animesh Sharma
Animesh Sharma

Reputation: 3386

This is not some security loophole. This is the way it is supposed to work.

Let's put aside the case of APIs. Consider the simple example::

I have a url: www.example.com/jobs/

This will list all the jobs on my website. No authentication or permission of any sort is required to access this data. I am providing it to every user that visits my website. Now I need a way to figure out if the user visiting my website wants to filter the jobs available on my website. So I provide this option in url kwargs. This will look something like::

www.example.com/jobs/java/

So, now the list will contain the data only for Java jobs. Plain and simple.

Now some day I decide that I will let only the registered users to view Java Jobs. So, I introduce a new check in my View that lets you access the java jobs only if you are logged into my website. Otherwise it redirects you to the login page. Depending on the requirement, you put restrictions on the data being sent to the user.

Same is the case with APIs. If you allow the data to be available to any user that uses the API, there is a flaw with your design and not with the concept of APIs. APIs are just the implementation of your logic.

If you don't want a user with id 12345 to access the data of a user with id 123, you have got to restrict the permissions on the API code. You have got to handle themselves. The API will respond to your code.

Hope this clears out everything.

Upvotes: 1

Related Questions