Live data from Hacker News

Ask HN: Unauthenticated Requests

news.ycombinator.com

1–2 of 2 posts

Ask HN: Unauthenticated Requests

Post by d10y3vh5 » Sun, Apr 11, 2021, 1:31 AM UTC

I work at a company that re transmits 911 alerts to security cneters on military bases. They alow unauthenticated requests like

``` post /alert {"911": "alert"} ```

that update the db and alert security personnel on base my question is? can this work or is this more trouble than its worth? if i post the url, is that crime?

Re: Ask HN: Unauthenticated Requests

Post by gregjor » Sun, Apr 11, 2021, 1:41 AM UTC

It's possible the request is authenticated/secured with a VPN, by requesting IP address(es), with an encrypted header, etc. There are multiple ways to authenticate an HTTP request. Maybe there's some authentication happening not visible in the API docs.

If anyone on the public internet can access that URL and post a request that seems like a bad idea.

Post reply on HN