C# - Securely send a GET request to HTTP?
C# - Securely send a GET request to HTTP?
I'm writing an application that will be distributed. I'd like to create a way for users to set up email alerts, that are triggered by the application itself. Since I definitely don't want to store my email password in the application, I figured I could create a PHP script on my server to handle the sending email, and forward the users email address and message through a GET request. My problem, is, I don't want the user to be able to see the http address that's getting hit (or rather, I don't want them to be able to use that GET method outside of the application).
I'm still rather new to programming and have no idea how to tackle this problem. I'd really appreciate any advice!
You can't conceal the URL, but you can include some kind of one-time-use authentication token / signature for your API. The tricky part is that it's not safe to embed secrets like private keys in your client application since they can be extracted from it. Is this a Windows client application? You could use Windows toast notifications instead of email.
– Dave S
Sep 8 '18 at 23:34
You are looking for Security through obscurity (hide url adress) which is not really secure
– Sir Rufo
Sep 8 '18 at 23:35
If I use SMTP to send an email directly from the application, it will require a username and password for authentication. This can obviously be reverse engineered and my password extracted. The application sits on the users computer and monitors server statuses for a popular online game. It allows users to create "triggers" based on the fluctuation of those server statuses (for example, I want to be alerted when my server moves from the status of "down" to any other status). My worry about using GET, is that someone would be able to see the URL I'm using, and manipulate it.
– Zach O.
Sep 8 '18 at 23:35
My feeling, if someone can extract email account info from your app, they can extract some hidden service call too no matter how much you try to hide it. Since you're talking about a desktop app here, why not just use the default mail client to generate the email rather than SMTP
– Hursey
Sep 8 '18 at 23:38
0
Thanks for contributing an answer to Stack Overflow!
But avoid …
To learn more, see our tips on writing great answers.
Required, but never shown
Required, but never shown
By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.
Some questions, what sort of app are we talking about here? Why would you be storing an email password in any case. How is having a service endpoint to generate an email any different to just generating the email directly from your software?
– Hursey
Sep 8 '18 at 23:31