Critical Information In REST URI

Question

I am developing a Spring MVC web service. I am trying to use best practices of REST URI design. For example for getting an account the URI will be

GET   http://blablabla.com/api/accounts/123

My question is what if the account number/id is critical information and must not be in URI. What is the best approach of URI design if the id that defines the resource is a critical information of a system. Should web service get the id in request header or body? Or hash the id and contain it in URI?

Thanks in advance.

Answer 1

If by "critical" you mean sensitive/secure, I'd keep URI design AS IS, and put whole session under HTTPS , that way it would be much harder for someone to eavesdrop on the URL itself. See for instance this question

If you mean that information is so sensitive that you don't even trust access logs in your own datacenter, then you have no choice other than put it into the body of the request. Headers are not for useful payload.

Answer 2

使用TLS和身份验证，您的痛苦就会消失。