出于安全性考虑，对REST API中的每个HTTP动词使用POST是否很好？

Question

I am working on an enterprise web app. Our app would be deployed to production in https only. We are writing REST APIs that would be consumed by our html 5 client only (not for others)

My team has taken decision to use POST for all rest verbs, because GET, PUT, DELETE exposes id in the url.

What my team thinks is that, having any type of data exposed in the url is not a good idea, even if id is not directly the database id.

Everybody seems to be agreed to use POST http method for GET, PUT, DELETE and pass http_method as parameter and using the parameter decide what operation to do.

This is the only difference that we are planning to do for REST APIs. What do you think?

Answer 1

By avoiding the use of GET you loose the ability to use caching. Hiding the id of the resource in the body will most likely cause you to violate the "identification of resources" constraint. Which will make linking/hypermedia far more difficult.

I would assert that it will be almost impossible to get the benefits of a RESTful system if you limit yourself to POST. Having said that, considering you are only targeting HTML5 clients you probably don't need most of the REST benefits. Doing Json-RPC is probably more than adequate for your needs.

However, I still think throwing away GET for a false sense of security is a bad idea. The body of your posts are just as easy to access by some intermediary as an id in the URI.

Answer 2

You should use HTTP as it was intended so you can get the full benefits of the stack. The different verbs have different semantics for a reason.

You can feel like POST is more secure than GET all you want, but it's a false premise.

Who are you securing this data from? Man in the middle? That's what HTTPS solves.

Are you securing it from your end users? The ones who can download your entire application and study the source code at their leisure whenever they want? Or view the source of a page with a right click and see your payloads laid out in all their glory? Or simply turn the browser debugger on and watch all of your traffic? You're trying to secure it from those people?

POST doesn't hide anything from anybody.

Answer 3

You should probably have a look at this post as it pretty much explains what https does for you. So the question would be: who do you want to protect the URL from? It might be in the browser history or visible to someone standing behind the user, but not to anyone listening on the line.