Passing username and password in HTTP GET query parameters

rest http authentication query-parameters
Hexdigit _ picture Hexdigit _ · Apr 24, 2016 · Viewed 20.7k times · Source

I'm building a RESTful API for my application and I would like to make it as clean and transparent as possible.

I need to create an authentication endpoint and it makes most sense to me to build it so that users can authenticate in a following way:

GET https://example.com/
    auth?identity=<username_or_email>&password=<password>

As I said, passing the user auth data using HTTP GET method in query parameters just seems very clean to me.

But I would like you to ask about how secure it actually is. Considering it will be encrypted through SSL/TLS, do you think it's a good idea to transfer user credentials like this?

Answer

Set picture Set · Apr 25, 2016

As Display Name said, both variants are basically plain text (even using base64 encoding). So you must use TLS or another protection like HMAC

But from other side, Query string is less secure in terms of how Server/Client works with URLs in general. You can read about this here or here. Briefly you should be worry about the following

  • URLs are stored in web server logs
  • URLs are stored in the browser history
  • URLs are passed in Referrer headers

Related questions

Place API key in Headers or URL

I'm designing a public API to my company's data. We want application developers to sign up for an API key so that we can monitor use and overuse. Since the API is REST, my initial thought is to put this …

Read More
How should a client pass a facebook access token to the server?

On every call to my REST API, I require clients to pass user's facebook access token, which authenticates the user. What's best practice for passing this token? maybe as a parameter behind the HTTP question mark GET /api/users/123/profile?…

Read More
PUT vs. POST in REST

According to the HTTP/1.1 Spec: The POST method is used to request that the origin server accept the entity enclosed in the request as a new subordinate of the resource identified by the Request-URI in the Request-Line In other words, …

Read More