以安全的方式将新密码传递给HTTP REST API端点

Question

I have an app, that has a REST API developed by me by WCF. It works great. It uses http basic authentication to authetnticate users, and https to secure data transport.

Now I should develop an API feature, that enables to change a user's password. I am afraid to pass the new password via URI, I feel it unsecure.

So, what would be a secure option to pass the new password to the API endpoint? Does it have some 'standard' way? Or passing it in the URI is secure?

Answer 1

I recommend you read this question about how secure is POST vs. GET. However, if you want it to be secure, be sure everything goes over HTTPS (both the basic auth, and requests to change the password).