It’s the first RESTful web service and I am concerned about security issues. Is it safe to transmit my access token via HTTP headers? For example:
POST /v1/i/resource HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Api-key: 5cac3297f0d9f46e1gh3k83881ba0980215cd71e
Access_token: 080ab6bd49b138594ac9647dc929122adfb983c8
parameter1=foo¶meter2=bar
The connection made over SSL. Also, What is need to be defined as the scope attribute for every access token
If you were to transmit access token header through HTTP, then it would be vulnerable to the man-in-the middle attack.
When you transmit access token header through HTTPS, then nobody apart from the client will be able to see this token as the request will be tunnelled through secure connection.
8
There are no serious issue in transferring access token over http headers because transferred data is encrypted when SSL is used, means it can be understand only by particular client which made that request and server who responses for the request, in between there are no chances to understand the data by any third party.
Other thing is access token are time based so they have a life for a specific period so they have no chances of use in future.
A thing to consider also is caching.
Your backend could see several calls to same URL, with same GET/POST parameters but a different header access token and consider content can be cached and severs to any body.