0

I'm new to WP-REST and need to build a REST API for a wordpress project, but I'm somehow wondering about one aspect. Good practices say, and the built-in WP API for posts also shows, that you should use only nouns in routes, and let the HTTP methods like GET, POST, PUT, and DELETE define what the respective endpoint does. For this, let's assume you have something like:

And with that route, you use:

  • GET https://example.org/api/v1/customers/<id> to get a customer
  • POST https://example.org/api/v1/customers + payload to create a customer
  • PUT https://example.org/api/v1/customers/<id> + payload to update a customer
  • DELETE https://example.org/api/v1/customers/<id> to delete a customer

Using this design, and extending it to relational endpoints, with sth like:

  • GET https://example.org/api/v1/customers/<id>/products/<prod_id> to get a customer's product X
  • DELETE https://example.org/api/v1/customers/<id>/products/<prod_id> to delete a customer's product X

However exposes practially your entire backend schema, including relationships of your tables or what they most likely are, to the public. I thus consider this as a security risk; and wanted to double-check: Am I missing out some fundamentals of REST API design? Or are you indeed supposed to expose your surrogate keys in REST APIs, like wordpress does it for example for posts?

Improve this question

1 Answer 1

Reset to default
1

You are right, APIs should not expose internal data and structures, but if you depend on APIs not written by you, it will rarely be a good use of your time to develop a different API just feel better about this.

And even if you develop your own API it is going to be hard to use for example something instead of post ids without making the API response even slower. You can probably use some kind symetric "encryption" for that, but I assume 99.9% of the developers will not see the point (I am in the 0.1%, but the reality is that something like that is unlikely to add any significant security for most sites)

Improve this answer
10
  • Thx! Yup the case would be for my own APIs of my own plugins, with my own, non-wp related databases. And I kind of agree to the pointlessness of an added encryption, UUIDs or whatever, in the end they're all an identifier that can be used to access your resource X. So in the end you're saying, "you theoretically shouldn't expose your surrogate keys and schema infos, but that's how you build rest apis", am I getting you correctly?
    – DevelJoe
    Jun 30, 2022 at 16:47
  • I guess what I am saying is that in the wordpress context where post ID and even user ID is exposed the extra protection is probably unlikely to add any real improvment in security. I imagine that this kind of internal information is hard to exploit without access to your DB, which hopefully no one has, otherwise you have a much bigger problem.
    – Mark Kaplun
    Jul 1, 2022 at 4:49
  • Yeah, especially the thing with the user ID also suprised me. If you check around in the forum, there are many posts saying that it shouldn't be a problem to expose your PKs in your APIs, as long as there's enough authentication + authorization implemented. And then there's the other people, which includes you and me, who think that it's generally bad practice. So it seems that it's rather opinion-based, as there are many other aspects involved (like performance, etc.). Some people even name their endpoints with their internal DB table names, which I feel is a horrible idea...
    – DevelJoe
    Jul 1, 2022 at 8:27
  • 1
    As for schemas, it do not provide information about internals, only externals. I saw the other question and my opinion of schemas is that they are not very useful for vlidation. For example how do you specify that a parameter can only be an odd int? Schemas might help a developer of a client in understanding the structure of the message, but can not be made specific enough to be used to drive input validation based on it. My experiance is that having one only makes you work harder, but it might be only me
    – Mark Kaplun
    Jul 1, 2022 at 17:28
  • 1
    ... and yes, schemas should not be exposed if they can be used to infer what is installed on the server, but there are many questions on this site about how to hide which plugins and themes are installed, and the general answer is that there are so many ways to discover it that the effort to hide it is mostly pointless. one more way do not make much of a difference (but I am totally with you, about minimising the exposure, again from a security in depth POV, not because of any specific threat)
    – Mark Kaplun
    Jul 1, 2022 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.