Sending the username and password in REST call

Question

I am making a REST call to an external system and the end point URL is defined as www.xyz.com/userid=XXX&Password=xyz. I need to set this as an endpoint when making a apex rest callout. Also I am using named credentials to set the end point URL and username/password.

But this is posing a security issue because userid and password should not be sent as part of the URL as it is visible to outside world. Also the external system understands userid and not username as parameter. How can I overcome this security issue. When talking to people I heard I should be sending the username and password in POST parameter of the body. Is this a fisible way? I do not want to change the code every time when the endpoint or username/password changes. I would like to use something like Named credentials for making changes instead of touching the code every time. Any ideas?

Answer 1

There is not a security ban on making rest calls with usernames and passwords for authentication to third party endpoints.

In general you want to avoid secrets written to server logs that log requests. But the issue with URLs that you refer to primarily refers to what appears in the URL bar of browsers -- e.g. clicking on a link with the username and password passed as parameters in the link, rather than making xhr or server-side callouts to third party servers.

This is because when the REST API is designed to accept auth data via URL parameters rather than headers, the endpoint is assumed to protect this information in the server logs. When the data is sent as part of routine browser APIs, the server may not be configured to protect this data.

Please check, however, that the REST endpoint responds with a content type header correctly set to application/xml or application/json.

If you have more questions, you can book an office hour to confirm that your API usage is secure.