Home/ Questions/Q 7657415
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-31T13:01:44+00:00

I have a RESTful rails backend where http requests(GET, PUT, POST, etc.) have much

  • 0

I have a RESTful rails backend where http requests(GET, PUT, POST, etc.) have much to do with controller actions (index, new, create, etc.)

I am building an android app, and I built an api_key controller that assigns all users with an api_key where from the mobile app, every request sends this api_key for verification.

Every request from android to rails has params[:api_key] for verification and it works.

Up until now, I have used both HttpPost and HttpGet, but I know that GET is insecure because it sends the parameters in the header. I don’t want someone to sniff the api_key in the header when I send HttpGet requests.

Then, is it possible to simply use HttpPost even in controller actions that generally require GET requests?

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Using the POST HTTP method does not make the data any more secure, if someone intercepts it then they can retrieve the API key whether it is attached to the URL or in a form.

    If you are worried about security, then you may want to think about using HTTPS or some kind of secure authentication system.

    With rails the method just determines where rails will route the request to. As long as the request ends up in the right action, in the correct controller then rails will provide the key in the params hash exactly the same whether it is attached to the URL as a paramater or in a form.

    • 0