将敏感信息发送到REST服务

Question

We currently have a SOAP based web service that our in house applications use to authenticate users. Basically, they send a SOAP request with the username and password. The web service authenticates their credentials against our data store and returns user information if the authentication is successful. The web service is secured using BASIC authentication and SSL.

We need to make modifications to this web service and I was considering re-writing it as a REST service. The REST services I have created in the past have been fairly simple and had no need for security. I have never created a REST service that used sensitive information, so I have a couple of questions / concerns:

First, is there a best practice for sending sensitive query parameters (user credentials) to a REST service securely? I can still use the BASIC authentication and SSL.

Second, if I send a query to a REST service using POST, is it still considered RESTful, or is GET required for REST queries?

Answer 1

You can use SSL and Basic authentication with REST web services as well.

HTTP GET is usually used for data retrieval (queries) but you can use HTTP POST as well. GET is especially useful if you can use any type of HTTP caching. POST is usefull if you need to transfer a lot of data to define your query or if your web service operation expects some complex data format instead of simple arguments.

Answer 2

Instead of doing the authentication via REST, you might also consider a networked authentication protocol to use in conjunction with web services. Technologies like Kerberos and OAuth were designed for these sorts of use cases.

To answer your questions, however:

1. REST encourages you to leverage HTTP and related protocols, so using SSL and BASIC authentication is quite appropriate.

2. REST encourages the use of not just GET and POST, but even other HTTP "verbs" such as PUT and DELETE. Use GET only for idempotent operations with no side-effects.

Answer 3

Going from SOAP to REST is taking a step backward as far as security goes.

As far as best practices:

• Don't roll your own security. Use a framework or existing library that has been peer-reviewed and tested.
• Don't pass unencrypted static keys. If you're using HTTP Basic and sending it across the wire, encrypt it.
• Ideally, use hash-based message authentication code (HMAC) because it's the most secure.

Why REST security doesn't exist