Discussions

 View Only
  • 1.  Security Concern

    Posted 11-19-2018 08:38
    Hi All,
    One of our client has raised the security concerns while accessing QuickBase Using API's.


    Following is the sequence of the calls made to access the QuickBase from the external system.


    First call for the authentication to get ticket:
    POST //db/main HTTP/1.1
    Host: https://target_domain
    Content-Type: application/xml
    QUICKBASE-ACTION: API_Authenticate
    Cache-Control: no-cache
    Postman-Token: a66300eb-891b-2764-d7ad-f4a6e0b45452


    <qdbapi>
       <username>USER NAME</username>
       <password>PASSWORD</password>
       <hours>24</hours>
    </qdbapi>


    O/P: Ticket


    After first call of authentication, when subsequent calls are made to the QuickBase without passing the Ticket ,
    still we get the desired output and this pose the serious security concern, 
    as anyone can do the random calls to the QuickBase and get Data till the ticket is valid.


    Second call without ticket:
    GET /db/bm272rhqa?a=API_DoQuery&amp;query={'3'.EX.'42'}&amp;clist=3 HTTP/1.1
    Host: https://target_domain
    Cache-Control: no-cache
    Postman-Token: e71e843e-1a90-54f8-cfac-80a6bfe8d89b


    O/P : Desired XML Data


    As a immediate fix we have asked the client to use "API_SignOut" API to invalidate the ticket, but still if ticket has duration of ,
    say of 4 hours and during that four hours is it possible to make sure that no API calls can be made to QuickBase without passing valid ticket in each API Calls.


    Thanks


  • 2.  RE: Security Concern

    Posted 11-19-2018 12:44
    >"when subsequent calls are made to the QuickBase without passing the Ticket ,
    still we get the desired output "

    I am not sure you are making the "subsequent calls" through postman or a browser or using some other user agent. The ticket is sent as a "httponly cookie" from the browser context meaning it cannot be accessed through client-side script and is sent to the server encrypted. The ticket does not appear in the URL or post body as it is sent as a secure httponly cookie in the header automatically. There is no security concern. QuickBase's security is very good and you are far more likely to have a user misplace or share their password or commit some other human error than to have someone steal your cookies.

    What is httponly cookie?
    HttpOnly is a flag added to cookies that tell the browser not to display the cookie through client-side scripts (document.cookie and others). The agenda behind HttpOnly is not to spill out cookies when an XSS flaw exists, as a hacker might be able to run their script but the fundamental benefit of having an XSS vulnerability (the ability steal cookies and hijack a currently established session) is lost.
    https://latesthackingnews.com/2017/07/03/what-is-httponly-cookie/


  • 3.  RE: Security Concern

    Posted 11-19-2018 21:36
    Shyam,
    Postman uses cookies just like a browser.  It is possible to clear them, then subsequent calls will fail.  Here are the docs:
    https://www.getpostman.com/docs/v6/postman/sending_api_requests/cookies
    Neil