Require authentication to view Sierra API documentation
Enhance cybersecurity by not revealing the api methods through the swagger interface to unauthenticated users. For example, a potential hacker can view the swagger interface which shows all methods and explains how to use them. This is an issue on all api endpoints including the iii sandbox. My idea is to only reveal the swagger methods to authenticated users.
https://sandbox.iii.com/iii/sierra-api/swagger/index.html#!/patrons
6
votes
Chris Jones
shared this idea
-
Greg Smith
commented
I have to agree. Even though it's slightly inconvenient and despite the fact that "security through obscurity" isn't a valid security control in and of itself, keeping the Sierra API documentation public could still make it easier to exploit any vulnerabilities that affect it.