search

w3c-ccg / http-signatures

Signing HTTP Messages specification
https://w3c-dvcg.github.io/http-signatures/
Other
34 stars 9 forks source link

Stance on using Query String instead of Header #97

Open JCapriotti opened 4 years ago

JCapriotti commented 4 years ago

I'm curious about the stance of using the query string to provide the Signature or Authorization value, as opposed to the header? I know there are definitely some things to consider with that approach, such as URL limits, possibly changing what values are required for the signing string, etc. In fact, in this scenario one probably will not include any headers in the signature string.

One use case I am thinking of is a mobile app that opens a URL in the device's browser. The mobile app may not be able to send headers, so would have no ability to sign the request.

Thanks, Jason

ioggstream commented 4 years ago

Sensitive information like Authorization should not be passed in query string.

Allowing insecure implementations is problematic: JWT needed a whole new draft to address security issues. My understanding is that we should focus on making this spec more secure.

Fetch specs support headers so afaik there should not be problems with mobile/client apps.

If you have a more specific use-case (eg. language, mobile framework, browser, ...) please share :)

My 2¢, R.

ioggstream commented 4 years ago

@msporny can we close this issue?

JCapriotti commented 4 years ago

Sorry I intended to provide more information, but time got away from me.

The scenario we have is using the NativeScript mobile application framework. NativeScript isn't super popular, but it basically just compiles down to native iOS and Android code. We're eventually moving to pure native.

Anyway, we have a login web page that is launched from the app. It will load using the device's native browser (Chrome or Safari, depending on the device). We require the request to the login page to contain a signature.

I believe when we call out to the browser from the app, we can pass headers to Chrome on Android. So that should work.

However, I do not believe this is possible with iOS and Safari. It's possible I'm missing the solution.

I'm not 100% clear on the Fetch spec link... it looks like that is more for client-side browser code?

I'm definitely not a security expert, but understand at a high-level why sensitive information should not be in a query string. In my case, the signature would only be valid for a short amount of time. I've also read some of how AWS Signature Version 4 allows query string parameters, so based some of my opinion on that.

Thanks for your responses!