I am little bit curious if there is some standard way how to handle http requests when only https request are allowed to be processed upon REST API. I found out that the partners has been in production sometimes calling our API via http and provided sensitive info (JWT, some ID and even password) via http (do not ask me why pls). The request has been off course refused (HSTS and redirected to https) but already went through public internet with all the sensitive data in it).
Would it be better to log such every request and looking for JWT pattern, or uuid and matching to existing ids and in DB the better way how to prevent partners credentials compromising and raising imminent alert? But that way can let some vulnerability that the api would be easily become overloaded with too many requests.
What is your way how to prevent such security breaches? OR do you event solving such cases? Or do you let it to partners responsibility (but how to prove than that the problem was upon partner side)?
I appologize, whether this is more philosophical than technical question. I would really appreciate your oppinions.
You need to sign in to view this answers
Leave feedback about this