敏感数据进入查询参数 GET Api

Question

I have a REST GET API, like

http://localhost:8080/users/ {userId}/assignments/{assignmentId}

Since, this is the GET call, so 'assignmentId' will get expose into URL while calling it.

This is the sensitive data for me & i don't want this to be expose publicly.

How can i overcome with this.?

Answer 1

Here are my two cents. Have you considered switching the service to be a POST with a request body that contains the sensitive data? That will solve the problem around not exposing the query param. I have seen services that accept a POST which returns data, but most of them do that to support unbounded inputs (as in retrieving data of multiple IDs).