Security of addOfflineDonation API

Chariot Developers

Hi,

I was reviewing the API documentation for adding offline donations and I am concerned with how we’d be sending this. The below screenshot indicates an unauthenticated POST request with donor info passed in the URL which is not secure. Sending sensitive data via URL parameters is considered to be a security vulnerability as it increases the exposure of the data (OWASP Resource for reference). The data may end up stored on systems such as proxy servers and other intermediary systems, in which case HTTPS/TLS will not protect it.

Is it possible to send this data via POST Body instead?

Chariot Developers

Hi @Elizabeth Favre . I saw you were helpful in answering a previous question relating to this API. Would you be able to help us out here? If not, do you know who we can reach out to about this?

Elizabeth Favre

@Chariot Developers
Thanks for reaching out. Let me do some research and I'll get back to you. ?

Elizabeth Favre

@Chariot Developers
Thanks again for this great question! I reached out to our amazing Luminate Online dev team and they had some answers for us both.

In the docs, Requires Authentication says No, but in reality authentication is required. This is a server call which requires login and password. It is recommended that permissions be limited via API Administrator accounts.

Regarding the use of personal data in URL calls, I am told that this page includes examples of putting parameters in the body of a message rather than the URL. To be honest, this bit of the feedback was a bit over my head. I need to reread this page a couple more times to really understand it. That might mean I need more coffee or, more likely, that we should make this bit of content more accessible. I am adding a review of this content to our product backlog.

Please let me know if you need more information. And please continue to let us know when the documentation needs to be more clear. That really helps us and the community.

Chariot Developers

@Elizabeth Favre

This is exactly what we were looking for (namely the second part about being able to put the query parameters of the API in the request body)! Thank you so much - this is very helpful.