0

I would like to implement REST APIs with the OAuth protocol for my web service. However I noticed that you must send datas over the internet that give the correct permissions to users.

The question that arose spontaneously is: how much is it insecure to send data without an HTTPS connection?

2 Answers 2

3

Any data not sent over https is ripe for being collected by some third party router between the web server and the end client.

Incidentally, you can use HTTPS with RESTful services.

2
  • What do you mean exactly for "incidentally, you can use"?
    – user502052
    Jan 3, 2011 at 20:37
  • 1
    @user502052: REST is an architecture built on top of http/https. All REST says is that you should use the normal verbs like GET, PUT, POST, and DELETE. The actual protocol (http/https) is independent of this.
    – NotMe
    Jan 3, 2011 at 20:46
1

Using OAuth 1.0 or 1.1 without HTTPS may well be insecure (although it was made to be used this way because of extra precautions taken when getting tokens and authorisation), but using OAuth 2.0 (the one used by facebook and most stuff now-adays) if totally insecure and actually goes against the specification for OAuth 2.0

It should be used and accessed over a HTTPS connection.

1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.