0

For rest security I want to send an application key and a hash with every request. Actually I would like to have it as url parameter like

 DELETE api.project.com/model/1?client=12345?hash=abcdef

Do you see any problem with this? Is there another way to send this data?

DarkLeafyGreen
  • 69,338
  • 131
  • 383
  • 601

1 Answers1

2

You should use Authorization HTTP header in request. If you send it as a query parameter it can be cached in many places i.e. user's browser, http caching proxy which may lead to leak of user's credentials.

On SO: Custom HTTP Authorization Header

Community
  • 1
  • 1
ragnor
  • 2,498
  • 1
  • 22
  • 25