CyberCertPrepWeb App FundamentalsAPIs & RESTEASYFree question
A REST API uses API keys for authentication. The API gateway logs include: 'GET /api/data?api_key=sk-live-abc123'. A security team spots this. What is the immediate action and the architectural fix?
- A.Rotate the exposed key and continue using query parameters
- B.Encrypt the API key before including it in the URL
- C.Immediately revoke and rotate the exposed key; it has been logged in plain text in server logs, proxy logs, and potentially CDN/monitoring systems. The architectural fix: API keys must be sent in the 'Authorization: Bearer' header (or a custom header) - headers are excluded from server access logs by default, unlike URL query strings
- D.Enable HTTPS to protect query parameter API keys
Why C is correct
API keys in URLs are a critical security antipattern: (1) server access logs record full URLs including query strings; (2) browser history stores the URL; (3) Referer headers may leak the URL to other services; (4) CDN and monitoring tools log full URLs. Once a key appears in logs, it must be considered compromised - rotate immediately. API credentials belong in headers: 'Authorization: Bearer sk-live-abc123' - most logging configurations exclude Authorization headers by default.
Know someone studying for Web App Fundamentals? Send them this one.