Contents
How does API handle sensitive data?
You should always stay informed on what data of yours can be shared, how that data is at risk, and how you can protect it.
- Implement authentication.
- Implement authorization.
- Validate all requests.
- Encrypt all requests and responses.
- Only include necessary information in responses.
Why get requests should never be used when dealing with sensitive data?
Of the request methods defined by this specification, the GET , HEAD , OPTIONS , and TRACE methods are defined to be safe. […] In the context of HTTP methods, safe is not related to security and, in a similar way, safe is not about how you deal with sensitive data.
What is sensitive data exposure?
Sensitive data exposure occurs when an application, company, or other entity inadvertently exposes personal data. This might be a result of a multitude of things such as weak encryption, no encryption, software flaws, or when someone mistakenly uploads data to an incorrect database.
How to create an API with sensitive data?
I’m designing api with method that should be an idempotent, and should not modify any data on the server. It should be method that process request and return response for given parameters. One of the parameters is sensitive data. It’s not an option to use additional encryption.
Which is the GET method in REST API?
Data is already encrypted, but security requirements are very demanding and even encrypted data should be treated very carefully. According to REST spec, idempotent query method should be implemented as a GET HTTP method.
Why is the security of the REST API important?
Security of sensitive data, be it organizational or personal information, is an important factor troubling developers and everybody nowadays. REST APIs is not an exception, being part of essential systems that require protection against security threats and breaches.
Can a GET method be used to get sensitive data?
According to REST spec, idempotent query method should be implemented as a GET HTTP method. Problem in this case is sensitive data that shouldn’t be pass as a GET parameter in URL. Only option in HTTP standard is to pass sensitive data in a body part of HTTP request.