Background:
I’m designing the authentication scheme for a REST web service. This doesn’t “really” need to be secure (it’s more of a personal project) but I want to make it as secure as possible as an exercise/learning experience. I don’t want to use SSL since I don’t want the hassle and, mostly, the expense of setting it up.
These SO questions were especially useful to get me started:
- RESTful Authentication
- Best Practices for securing a REST API / web service
- Examples of the best SOAP/REST/RPC web APIs? And why do you like them? And what’s wrong with them?
I’m thinking of using a simplified version of Amazon S3’s authentication (I like OAuth but it seems too complicated for my needs). I’m adding a randomly generated nonce, supplied by the server, to the request, to prevent replay attacks.
To get to the question:
Both S3 and OAuth rely on signing the request URL along with a few selected headers. Neither of them sign the request body for POST or PUT requests. Isn’t this vulnerable to a man-in-the-middle attack, which keeps the url and headers and replaces the request body with any data the attacker wants?
It seems like I can guard against this by including a hash of the request body in the string that gets signed. Is this secure?
