News for hackers. Stuff that matters.

A comment on Use links not keys to represent relationships in APIs. Parent comment

Re:Use links not keys to represent relationships in APIs by raquo on Sunday May 12, 2019 @05:19AM (#19890928)
(Not the GP) Yes, when done right, but it's iffy.

For example, the article includes URLs like "/people/123". The security of having a leading slash in these depends on API base URL.

"https://api.hotstartup.com/v1" – safe

"https://api.hotstartup.com" – unsafe with ".evil.com/people/123"

I wouldn't really call this particular scenario a security issue, but allowing such things is a bad habit that will eventually bite. It's like not HTML-encoding values like usernames that you "know" are safe (but you know are not HTML-encoded).

[ Parent | on HN ]
Re:Use links not keys to represent relationships in APIs by nertzy on Sunday May 12, 2019 @12:57PM (#19893002)
Yes, this is why developers should use URI-building libraries instead of direct string manipulation to modify URIs.

If I visit an HTML page with a link to “.evil.com/people/123” and click on it, the user agent won’t append “.evil.com” to the hostname. You’d instead get something like “https://api.hotstartup.com/.evil.com/people/123” which would be safe (if not broken).

[ Parent | on HN ]