3

We're developing an Angular application that consumes a web method exposing some information that is not sensitive, just bus seat promotions; the user enters where he wants to go and when and he will be presented with the available offers (if any). The site does not require any kind of authentication for this information is publicly available and it is just trying to offer an easy way to gather this information for the public.

There's been an argument about whether it is convenient to implement OAUTH on the service itself, creating a service account for the angular application so we know that no one else is trying to access this information. The way I see it, I don't think it is necessary, this is publicly available info and if they want to access it they can parse the information on the site or even figure out the credentials that the Angular app is using. Is there any benefit that I'm missing here?

Improve this question
11
  • Someone can automated request to your web method and your server would be down. Is it kind of secure what you consider ?
    – Engineert
    Mar 20, 2019 at 15:23
  • 1
    Does not this also apply to the site itself? Some could request my site a zillion times and get the same result.
    – Zalomon
    Mar 20, 2019 at 15:25
  • 1
    Could someone take profit of such public resources so that could make you lose gains? I ask this because I know a case where a casual developer defeated an official app creating a better one based on the public API of the former.
    – Laiv
    Mar 20, 2019 at 16:20
  • Don't really think so, this site is not meant to make any kind of profit, it does not even allow buying the seats. The whole point of this app is to take away some load from the main app in which you can buy the tickets so it is not disturbed by people looking for promotions but not actually buying anything.
    – Zalomon
    Mar 20, 2019 at 16:25
  • It's not about buying, it's about unfair competition.
    – Laiv
    Mar 20, 2019 at 16:51

1 Answer 1

Reset to default
6

Authentication does more than protect data. It protects a resource.

You say the data is publicly available but is the service meant to be publicly available? Being publicly available costs time and money. For example, now you need a plan for handling DDoS attacks.

Now sure, implementing OATH costs time and money as well. That's why asking "is it convenient?" is a very wise question. Identify the risks and estimate the potential for damage. Then estimate the cost of mitigating those risks.

This is called cost benefit analysis. It can help you make this decision. However it has a downside. Some companies obsess on mitigating risk. Trying to apply this can give you tunnel vision. You start to think cost is the only consideration.

Time is another huge one. Many potential problems are best dealt with once they're actual problems. Why? Because what we predict and what happens are rarely the same.

Public relations shouldn't be ignored either. Maybe you think this data isn't sensitive in this context but if you let anyone have it then it can end up it very different contexts and be analyzed in ways you never intended. You'll only learn how once it hits the news.

But maybe making this data publicly available on your site is for the public good. Maybe it will help promote your company. If that makes this all worth it to your company then go ahead.

Improve this answer
9
  • In this case data is publicly available by definition and hugely unlikely to change, the site is just for looking at promotion, they can't even buy any seats on the bus. Also the site does not have any kind of authentication either. Sure DDos is a concern but the same applies to the site. If it was my call, maybe I would invoke these services on the server side and then there would be just one point of entry for this type of attacks but that part of the architecture is closed.
    – Zalomon
    Mar 20, 2019 at 16:21
  • 2
    @Zalomon then consider how hard it would be to identify traffic hitting your service that isn't coming from your application. As long as you don't lose the ability to separate them later if needed it's likely ok not to care now.
    – candied_orange
    Mar 20, 2019 at 16:39
  • Imagine you have to scale the service because someone is consuming your service. Would you be "happy" paying the bills?
    – Laiv
    Mar 20, 2019 at 16:53
  • 1
    People accessing the site massively see your adds massively (or whatever else you're promoting). People consuming the service only get your data. If your OK with that fine. If so I'd love to know how your business plan works.
    – candied_orange
    Mar 20, 2019 at 17:04
  • 1
    @Zalomon hmm so you're really just promoting the data. How refreshing.
    – candied_orange
    Mar 20, 2019 at 17:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.