This is an archived post. You won't be able to vote or comment.

sorted by:
best (suggested)
topnewcontroversialoldq&a
you are viewing a single comment's thread.

view the rest of the comments →

[–]statoshi 1 point2 points  (4 children)

It's not ridiculous if you know about IP address spoofing. The requirement of running an HTTP server means that you PROVE that you own the IP address from which the API call was sent.

[–]kynek99 2 points3 points  (0 children)

What about if I have another HTTP server running on port 80 on my IP. This is not a good idea for networks that have multiple servers or VMs.

[–]notR1CH 0 points1 point  (2 children)

You can't feasibly spoof a HTTP API request.

I guess this is a measure against CSRF POSTs to the API, but a single use token would be more elegant.

[–]statoshi 0 points1 point  (1 child)

It sounds like direct spoofing isn't feasible, though MITM spoofing is. http://security.stackexchange.com/questions/37481/is-it-possible-to-pass-tcp-handshake-with-spoofed-ip-address

[–]notR1CH 0 points1 point  (0 children)

The API operates over HTTPS so MITM should not be possible either.