Pita/etherpad-lite — Issue #284: API Key send unencrypted
Author: kunoFM
Created: 2011-12-09 12:37:05+00:00
State: open

As far as I can see it, the API key is sent in plain text with every API request. Given the fact, that everybody, who knows the API key can completely manage your server, this might be a bit problematic, or did I get anything wrong?

Other projects (like bigbluebutton http://code.google.com/p/bigbluebutton/wiki/API#API_Security_Model ) use the API key as a salt to generate a checksum for every request. That way, the request can not be manipulated and the key itself is not sent in plain text.

The API clients would need to make this change too, of course, but it would be very easy to implement.