# Security for the invitation endpoint in Invitation System

**URL:** <https://discuss.jsonapi.org/t/security-for-the-invitation-endpoint-in-invitation-system/1763>\
**Category:** Uncategorized\
**Created:** [November 27, 2019, 1:39am UTC](https://discuss.jsonapi.org/t/security-for-the-invitation-endpoint-in-invitation-system/1763 "2019-11-27T01:39:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![a-komarev](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.jsonapi.org/a-komarev/32/440_2.png) [@a-komarev](https://discuss.jsonapi.org/u/a-komarev)\
**Post date:** [November 27, 2019, 1:39am UTC](https://discuss.jsonapi.org/t/security-for-the-invitation-endpoint-in-invitation-system/1763/1 "2019-11-27T01:39:25Z")

</div>

Hey folks!

I’m designing Invitation System and want to hear your thoughts about security concerns and best practices.

From email user will be landed to the webapp endpoint:

```auto
GET /accept-invitations/:invitation_id?token=:secret_token

```

From this webapp page guest’s client will call an API endpoint to fetch information about the invitation. By strictly following `json:api` specification it might be:

```auto
GET /api/invitations/:invitation_id?include=team,inviter

```

Accepting\declining an invitation will require secret token which will be present in invitation email only, but bad people could bruteforce an API endpoint to try to find working ids and get access to the private `team` & `inviter` resources. Isn’t it a security breach then?

Pinging @sled as author of the topic about [modelling an invitation system](https://discuss.jsonapi.org/t/modelling-an-user-invite-with-json-api/729).

---

<div class="post-metadata">

**Author:** ![ekampp](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.jsonapi.org/ekampp/32/647_2.png) [@ekampp](https://discuss.jsonapi.org/u/ekampp)\
**Post date:** [December 2, 2019, 7:37am UTC](https://discuss.jsonapi.org/t/security-for-the-invitation-endpoint-in-invitation-system/1763/2 "2019-12-02T07:37:28Z")

</div>

It’s always a security tradeoff when exposing information to the wider internet in a way that allows semi-anonymous access.

You can mitigate the issue by adding rate limiting to the API. E.i. after a specific invitation ID has been called more than 5 times with an invalid secret that invitation ID is locked for an hour.

---

<div class="post-metadata">

**Author:** ![maark](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.jsonapi.org/maark/32/184_2.png) [@maark](https://discuss.jsonapi.org/u/maark)\
**Post date:** [December 3, 2019, 11:26pm UTC](https://discuss.jsonapi.org/t/security-for-the-invitation-endpoint-in-invitation-system/1763/3 "2019-12-03T23:26:17Z")

</div>

What is insecure if you use have secret token? (Here I’m assuming it is strong enough)

What is the JSON:API question here?

---

<div class="post-metadata">

**Author:** ![a-komarev](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.jsonapi.org/a-komarev/32/440_2.png) [@a-komarev](https://discuss.jsonapi.org/u/a-komarev)\
**Post date:** [December 4, 2019, 11:47am UTC](https://discuss.jsonapi.org/t/security-for-the-invitation-endpoint-in-invitation-system/1763/4 "2019-12-04T11:47:11Z")

</div>

JSON:API question because it defines that access to every resource should have its ID in address bar, but usually invitation systems don’t exposure ids of secret tokens.