Secure Transmission of API Passwords | Archive

Adam_Hahn · 2016-01-07T14:40:42Z

Currently when communicating with the Logic Monitor API, passwords are required to be sent via Plaintext in the URL. This results in the username/password of the api account being intercepted anywhere logging of the URL occurs(proxies/network logging/etc).Additionally, since LM treats API users like any other user, having the user/pass in plaintext permits anyone who sees the URL to log into the LM web interface as the API user and see or do anything the API user can do.This can be prevented by making some relatively simple changes to the API handler.1) Permit the arguments of a API request to be made via POST instead of GETHTTPS POST requests will ensure that the vars are encrypted with the rest of the HTTPS request.2) Permit hashing of the passwordThis prevents those who see the password from being able to access the LM web-interface and obfuscates the clear-text version of the password.PS: Call me paranoid if you want, but communication with the LM API is done over the public internet and plaintext passwords make me nervous /emoticons/unsure.png" width="20">

MoreDiscussions

Secure Transmission of API Passwords | Archive | LogicMonitor Community