Credentials in URL

owasp:api2:2019-no-credentials-in-url

Rule Severity:

High

Ensure that security credentials are excluded from paths and query parameters.
This rule applies at the API Specification level (OAS/Swagger).
URL parameters should not include sensitive information such as API keys, passwords, or secrets.

1. How to Identify with Example Scenario

Find the text in bold to identify issues such as these in API specifications

paths:
 /mypath/{id}/: # arbitrary path name
   get:
     description: 'get'
     parameters:
‍        - name: client_secret
         in: query
‍          required: true
‍        - name: token
         in: query
‍          required: true
‍        - name: refresh_token
         in: query
‍          required: true
       - name: id_token
         in: query
‍          required: true
‍        - name: password
         in: query
‍          required: true
‍        - name: secret
         in: query
‍          required: true
       - name: apikey
         in: query
‍          required: true
      - name: apikey
         in: path
‍          required: true
      - name: API-KEY
         in: query
‍          required: true

2. How to Identify with Example Scenario

Find the text in bold to identify issues such as these in API specifications

1. How to Resolve with Example Scenario

Find the text in bold to identify issues such as these in API specifications

paths:  
/mypath/{id}/: # arbitrary path name
   get:
     description: 'get'
     parameters:
       - name: id
         in: path
         required: true
       - name: filter
         in: query
         required: true        # Remove all sensitive data from the path or query

2. How to Resolve with Example Scenario

Modify the text in bold to resolve issues such as these in API specifications
References:

More findings

All Findings
Unrestricted string
Missing 429 response
Missing rate limit headers
Missing 401 response
Missing array limit
Numeric IDs

Resource center

Check the FireTail blog and research documents for up-to-date information.

FireTail Now Available on AWS Marketplace
September 27, 2023

FireTail Now Available on AWS Marketplace

The addition of FireTail marks a significant milestone in our mission to provide state-of-the-art API security solutions to organizations around the world. Now, AWS customers can unleash the power of FireTail quickly, easily and confident in the knowledge that the platform integrates perfectly with their cloud environment.

Read more
FireTail Secures SOC 2 Type 2 Certification
September 15, 2023

FireTail Secures SOC 2 Type 2 Certification

At FireTail, we are very pleased to announce that we have achieved SOC 2 Type 2 accreditation. This certification is an important milestone in our ongoing journey to ensure we adhere to the highest industry standards when it comes to data protection and cybersecurity.

Read more
The Complex Connections between Generative AI and API Security
September 14, 2023

The Complex Connections between Generative AI and API Security

APIs and Artificial Intelligence are two of the most important developments in tech of the last 10 years. In this post, we look at the dual impacts that connect these two hot topics that make our online worlds work.

Read more
Browse all articles