CyberCertPrepWeb App FundamentalsAPIs & RESTEASYFree question
An API key is included in the URL: GET /api/data?api_key=abc123. Why is this a security anti-pattern?
- A.API keys should always be Base64-encoded before use in URLs
- B.Query parameters are not transmitted over HTTPS
- C.URL parameters appear in server access logs, browser history, Referer headers, and CDN logs - the API key is logged everywhere. Keys should be sent in headers (Authorization or X-API-Key) which are less likely to be logged by intermediaries
- D.URL length limits prevent using API keys in query strings
Why C is correct
API keys in URLs are a known anti-pattern. Server access logs, CDN logs, proxy logs, analytics platforms, and browser history all record the full URL. Referer headers can leak URLs to external sites. This is why payment APIs, AWS, and cloud providers use header-based authentication. If you must pass credentials in a URL (e.g., for webhooks), treat the URL as a secret and use short-lived, scoped tokens.
Know someone studying for Web App Fundamentals? Send them this one.