News for hackers. Stuff that matters.

A comment on What’s your API’s “Time To 200”?. Parent comment

Re:What’s your API’s “Time To 200”? by aszen on Saturday May 22, 2021 @01:43PM (#27248705)
famous example of this, are most of the aws api's that because of their signing features and hashes can really only be called sanely from an sdk.

such a pain to debug, i'm not sure why they have such signing features. is it for security

[ Parent | on HN ]
Re:What’s your API’s “Time To 200”? by dragonwriter on Saturday May 22, 2021 @02:06PM (#27248895)
> is it for security

Yes.

EDIT: specifically, it is do intercepting a request doesn’t allow you to issue new requests.

[ Parent | on HN ]
Re:What’s your API’s “Time To 200”? by aszen on Saturday May 22, 2021 @11:27PM (#27252175)
Isn't that what https provides. Or were the APIs creates before https was popular
[ Parent | on HN ]
Re:What’s your API’s “Time To 200”? by j16sdiz on Sunday May 23, 2021 @06:23AM (#27253917)
The use case is different.

For example, S3. S3’s authentication scheme allow you create a limited used download link and passing to a untrusted user

[ Parent | on HN ]
Re:What’s your API’s “Time To 200”? by marcosdumay on Saturday May 22, 2021 @02:47PM (#27249206)
> is it for security

It is because TLS client certificates do not exist.

[ Parent | on HN ]
Re:What’s your API’s “Time To 200”? by nexuist on Saturday May 22, 2021 @08:31PM (#27251466)
I would say it is fair for AWS to have a complicated signing method, because you really do not want your AWS account falling into the wrong hands or being intercepted through some MITM attack. With an AWS account an attacker can bankrupt you pretty much instantly.
[ Parent | on HN ]