4

I have a route in a RESTful API where I need to pass a single username (email address) but not password. The route is designed to have GET method, so my options are either query parameters or a custom HTTP headers.

I read that sending usernames via query parameters is not a good practice, but could not find any related information concerning custom header.

Could you please share your suggestion regarding this?

  • 3
    Do you understand why sending the username as a query parameter is a bad idea? If you do, do those reasons also apply to a custom HTTP header? – Philip Kendall Nov 3 '17 at 23:38
5

I read that sending usernames via query parameters is not a good practice

Where have you read that?

There are a few things you should take care of when sending anything through a query parameter of an HTTP GET:

  • Sensitive information. Putting such information in the URI is plainly wrong. Although query parameters are encrypted when using HTTPS, those parameters are still usually saved in a non-secure way. HTTP logs are one of the examples where sensitive information has no place.

  • Long parameters. Although HTTP is quite permissive when it comes to long URIs, your infrastructure may not be that permissive. For instance, the default limit (which can be changed easily) for an entire URI in HAProxy is 8K, and some applications could expect shorter URIs.

  • Unicode characters. By itself, Unicode characters in URIs have nothing wrong, however, you have to ensure your application handles them correctly both when sending them (through AJAX or hyperlinks) and receiving them on server side.

  • Security. If an URI such as https://example.com/login/user1 logs in the user user1, this may not be what you want in terms of security. More seriously, never trust any input, and this rule includes the user name: the fact that someone told you in the request that he's the user1 doesn't mean anything. Do ensure that usernames are used in a correct context. An example of a correct context would be https://example.com/profile/user1, a page which leads to the public profile of the user, or, similarly, https://blog.example.com/posts/user1.

Usernames are not sensitive information: they are often the only information about the user which is public. They are not expected to be extremely long either, or you'll probably have more important concerns than the length of your URIs anyway. They can and usually will contain Unicode characters, but as soon as you check that your app handles that well, there is no issue there either. Same goes for the security: if you use the input wrongly, you'll still have the exact same issue with HTTP headers or any form of input.

So no, you don't have to “hide” usernames anywhere, would it be in the HTTP headers, cookies or request body.

  • Thanks for your detailed answer. The OWASP Password Forgot Cheat Sheet says - 'Avoid sending the username as a parameter (hidden or otherwise) when the form on this page is submitted. The username should be stored in the server-side session where it can be retrieved as needed.' But I have just notices that it also refers to keeping username in server session which I am not using session. Well in this case I'll stick to either parameters or headers. – Emil Gurbanov Nov 4 '17 at 0:04
  • 1
    @EmilGurbanov: this corresponds to the fourth point in my answer: input which shouldn't be trusted. – Arseni Mourzenko Nov 4 '17 at 0:12
  • Or in other words, use cryptographically sound security tokens (such as JWT) for session-less web services, not just a username. – Sebastian Redl Nov 4 '17 at 9:07
  • 1
    @EmilGurbanov: The OWASP cheat sheet is saying not to trust a username when the user is performing an action. "I am user X and I can prove it with password Y" is fine whereas, "I am user X therefore I am allowed to perform action A" is not fine. Normally, in response to a user proving their identity, the user sends a security token so that all future responses to perform action A will be of the form, "I have security token S, which proves I am user X, which shows that I am allowed to perform action A" or "I have security token S, which says I can perform action A." – Brian Nov 8 '17 at 14:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.