It's the first RESTful web service and I am concerned about security issues. Is it safe to transmit my access token via HTTP headers? For example:POST /v1/i/resource HTTP/1.1Content-Type: application/x-www-form-urlencodedApi-key: 5cac3297f0d9f46e1gh3k83881ba0980215cd71eAccess_token: 080ab6bd49b138594ac9647dc929122adfb983c8parameter1=foo&parameter2=barThe connection made over SSL. Also, What is need to be defined as the scope attribute for every access token
Is it safe to transmit access tokens via HTTP headers?
api;rest;http;headers;http request
If you were to transmit access token header through HTTP, then it would be vulnerable to the man-in-the middle attack.When you transmit access token header through HTTPS, then nobody apart from the client will be able to see this token as the request will be tunnelled through secure connection.