{"action":"created","issue":{"url":"https://api.github.com/repos/woothemes/woocommerce/issues/10475","repository_url":"https://api.github.com/repos/woothemes/woocommerce","labels_url":"https://api.github.com/repos/woothemes/woocommerce/issues/10475/labels{/name}","comments_url":"https://api.github.com/repos/woothemes/woocommerce/issues/10475/comments","events_url":"https://api.github.com/repos/woothemes/woocommerce/issues/10475/events","html_url":"https://github.com/woothemes/woocommerce/issues/10475","id":138434945,"number":10475,"title":"Secure api request","user":{"login":"brokleen","id":7378894,"avatar_url":"https://avatars.githubusercontent.com/u/7378894?v=3","gravatar_id":"","url":"https://api.github.com/users/brokleen","html_url":"https://github.com/brokleen","followers_url":"https://api.github.com/users/brokleen/followers","following_url":"https://api.github.com/users/brokleen/following{/other_user}","gists_url":"https://api.github.com/users/brokleen/gists{/gist_id}","starred_url":"https://api.github.com/users/brokleen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brokleen/subscriptions","organizations_url":"https://api.github.com/users/brokleen/orgs","repos_url":"https://api.github.com/users/brokleen/repos","events_url":"https://api.github.com/users/brokleen/events{/privacy}","received_events_url":"https://api.github.com/users/brokleen/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-03-04T10:08:31Z","updated_at":"2016-03-07T12:34:47Z","closed_at":"2016-03-07T12:34:47Z","body":"Hi, i would like to use the woocommerce rest api with my mobile app but i have a security problem. \r\n\r\nI have created a login route with the wordpress rest api, if the login is correct the function return an token.\r\nThis token is validated in the authenticate function (class-wc-api-authentication.php) for each woocommerce api requests. \r\n\r\nTo make requests, i need to send the consumer key, the secret key and the token. \r\n\r\nImagine that case \r\nI have 2 users, and the first user try to hack my app and get all this keys. \r\nNow he just need to send\r\nDELETE www.mydomain.com/wc-api/v3/customers/2?consumer_key=123&consumer_secret=123&token=123 \r\n\r\nfor delete the second user.\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/woothemes/woocommerce/issues/comments/193232586","html_url":"https://github.com/woothemes/woocommerce/issues/10475#issuecomment-193232586","issue_url":"https://api.github.com/repos/woothemes/woocommerce/issues/10475","id":193232586,"user":{"login":"mikejolley","id":90977,"avatar_url":"https://avatars.githubusercontent.com/u/90977?v=3","gravatar_id":"","url":"https://api.github.com/users/mikejolley","html_url":"https://github.com/mikejolley","followers_url":"https://api.github.com/users/mikejolley/followers","following_url":"https://api.github.com/users/mikejolley/following{/other_user}","gists_url":"https://api.github.com/users/mikejolley/gists{/gist_id}","starred_url":"https://api.github.com/users/mikejolley/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikejolley/subscriptions","organizations_url":"https://api.github.com/users/mikejolley/orgs","repos_url":"https://api.github.com/users/mikejolley/repos","events_url":"https://api.github.com/users/mikejolley/events{/privacy}","received_events_url":"https://api.github.com/users/mikejolley/received_events","type":"User","site_admin":false},"created_at":"2016-03-07T12:34:47Z","updated_at":"2016-03-07T12:34:47Z","body":"You'd either need to keep the keys secured on your middleware and auth the user with your service, or keep the user's keys local on their device and make requests from that to the API I assume. Not 100% sure - the rest API doesn't handle 'logins', only data manipulation with valid keys."}}