Search code examples
resthttpgetjwt

Can I send access token using GET method?

I'm building RESTful API, but I have some question while implementing /valid endpoint.

/valid endpoint checks token expiration.

  1. Is GET method good choice for this endpoint?

  2. Is there any problem with sending token using GET method? (like http://some.api/valid?access_token=ACCESS.TOKEN.STRING )

Solution

  • If you use GET, your server log will be full of access tokens. This may be a security issue to consider.

    What you're doing is essentially RPC, passing a parameter (access token) into a function (validate).

    To do it using REST, you could consider the resource as the access token. As you have it, it's already been created (POST) so you would want to interact with it in some way. PUT updates a resource but you're not updating but you're not using REST either so it doesn't really matter. You could use POST but as I said, the resource (access token) has already been created.

    So to get as close as possible to REST, you could:

    PUT /accesstoken/validate
body: ACCESS.TOKEN.STRING

    and get a suitable response. It also allows the server to track whether the access token has ever been validated, if that's of relevance. As it's RPC, it means the server could do other things that may update the resource in some way. i.e. number of times it's been validated and the ip address it was validated from, increasing security perhaps.