Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>Firstly, you were correct that having the token in the URL (or anywhere else) was a security risk over HTTP. However, now that you are on HTTPS, it should not matter whether you have the API token in the URL or you are transmitting it in some other way. The URL should be as secure as any other part of the transaction. I say "should" because in practice your internal infrastructure may do logging, metrics collection or reporting that reveals the URL slightly more easily than you intend. And the client may submit the visited URL (but not other info) to its own logging system or to a smart search service like Google, etc. But for most use cases and in most configurations this is not a major issue.</p> <p>But it sounds from your question like you are talking about not removing the token from the URL and adding it to the HTTP headers or some other fashion, but actually removing the token concept entirely.</p> <p>So what you should ask is, what is special about HTTPS that makes the token unnecessary? HTTPS secures the communication but it does not authenticate the client. Except in very unusual configurations, anyone can connect via HTTPS and issue commands, and unless you have some method of authentication the HTTPS will not protect you from unauthorized access. If you are using cookies for authentication, or if you are passing the token via HTTP headers (which is actually how I prefer to handle tokens when possible) then your need for authentication is satisfied and you do not need the token. If you do not have any other form of authentication, and you need authentication for security on your website, then you do need the token.</p>
    singulars
    1. This table or related slice is empty.
    1. POAuthenticating users with tokens useless after HTTPS?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. This table or related slice is empty.
    1. USAndrew Gorcester
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. POAuthenticating users with tokens useless after HTTPS?
      singulars
      1. PTQuestion
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COThanks for the reply! Currently, I authenticate users (with username and password) first time they launch the app, then I store a cookie with their username and token and then use userid+token in any request they make to validate it. I am just thinking that since I'm using HTTPS now that I can skip the token entirely. So authenticate the users first time and then allow them to do actions based on their usernames only. Am I making any sense?
      singulars
      1. PO
      1. USMinaHany
    2. CO@MinaHany no, HTTPS prevents _others_ from listening in on the communication between client and server. It does not hinder malicious clients. A user can view and alter HTTPS traffic before it's sent, so user A can do a request with user B's name.
      singulars
      1. PO
      1. USCodeCaster
    3. CO@CodeCaster so if A found out the http request that B sends, they can do requests on their behalf after that token or no token, but other users would still be protected if I had a token because A doesn't know their tokens?
      singulars
      1. PO
      1. USMinaHany
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload