US Post Office Web Tools gives away your password

		Print
		Email weblog link
		Discuss
		Blog this

brian d foy
Feb. 25, 2005 03:12 AM
Permalink

URL: http://www.usps.com/webtools/technical.htm...

I applied for a User-ID and password so I could use the US Post Office's web services. They have some promising looking tools: zip code lookup, city/state lookup, address verification, and some other things.

A couple of hours after I applied for an account, I got my welcome email. I was on to the next task though, so I filed it. Tonight I wanted to take it for a spin.

I wrote a little program to give it a go. I didn't follow their technical details because I don't want to put a long XML string in the query string of the XML. This is an idempotent request, but I'll put that stuff in the message body anyway and use a POST request.

Here's the code. Notice I have my ID and password in the environment. The USPS says on just about every other page that I can't give out those credentials. I can't share them and I can't tell anyone else what they are. Fair enough.

Look at the request scheme though! It's plain ol' HTTP. That's plaintext floating across the air, or copper, or whatever. I tried sticking https in there, but it never makes a connection. Every time I test this little application, I'm exposing my credentials. You don't have to hack ChoicePoint to get that.

use HTTP::Request;
use LWP::UserAgent;

my $content =<<"HERE";
API=Verify&XML=<AddressValidateRequest
	USERID="$ENV{USPS_ID}"
	PASSWORD="$ENV{USPS_PASS}">
<Address ID="0">
<Address1>5250 N. Kenmore Suite 157</Address1>
<City>Chicago</City>
<State>IL</State>
<Zip5>60640</Zip5>
</Address>
</AddressValidateRequest>
HERE

my $ua = LWP::UserAgent->new();

my $request = HTTP::Request->new( POST =>
'http://testing.shippingapis.com/ShippingAPITest.dll' );
$request->content( $content );

print $request->as_string;

my $response = $ua->request( $request );

print $response->as_string;

Okay, it's their system and a password to their system. Obviously they know what they are doing. They are the government after all.

Not so fast. Check out this response: All I really have is a User-ID and password. I can't actually use the service, even on the testing service. It turns out that I have to request that separately. Ughh. Not only that, they are using IIS. Oh boy, so this service will down a lot, won't it? I'll have to wait to see about that because I need someone to authorize me to use the web service I signed up for two weeks ago.

HTTP/1.1 200 OK
Connection: close
Date: Fri, 25 Feb 2005 11:04:46 GMT
Server: Microsoft-IIS/5.0
Client-Date: Fri, 25 Feb 2005 11:04:40 GMT
Client-Peer: 56.0.134.43:80
Client-Response-Num: 1

<Error>
	<Number>80040b1a</Number>
	<Description>API Authorization failure. 
User 931THEPE4647 is not authorized to use API Verify.</Description>
	<Source>UspsCom::DoAuth</Source>
</Error>

brian d foy is a Perl trainer for Stonehenge Consulting Services and is the publisher of The Perl Review.

Comment on this weblog
You must be logged in to the O'Reilly Network to post a comment.

Showing messages 1 through 4 of 4.

• USPS Web"tools"
  2005-04-25 13:17:27  Obelix [Reply | View]
  
  
  Brian,
  
  Have you had any follow up with this? I just registered and spent about 1/2-hour dicking around with requests that return "80040b1a API Authorization" failures.
  
  According to the USPS email WRT the username and pwd:
  "They are necessary for you to begin sending calls to the Test Server as soon as you are ready."
  
  Well, I'm ready. Where the heck does it mention that I need to activate anything?
  
  Also, are the requests returned as well formatted XML? Their lame-assed responses for errors leave me expecting disapointment.
  
• USPS Web"tools"
  2005-06-14 14:49:49  wmlanza [Reply | View]
  
  
  Have you solved the Authorization Problem? I have been d*ckin' around with this for a couple days. USPS never responds to help requests.
  

• USP Authorization
  2005-06-14 14:49:02  wmlanza [Reply | View]
  
  
  Have you solved the Authorization Problem? I have been d*ckin' around with this for a couple days. USPS never responds to help requests.

• USPS Webtools
  2005-06-28 09:32:57  USPS-ICCC [Reply | View]
  
  
  For assistance with the webtools, email the USPS ICCC at icustomercare@usps.com or call 800/344-7779. Access to the address informational API's (City/State Lookup, Verify, Zipcode Lookup) require additional permissions. Please go to http://www.usps.com/webtools/webtoolsapirequestform.htm to complete the application for these permissions. If you plan to use the other webtools the USPS offers such as rate lookups, label generation, tracking, etc; you have the necessary permissions to begin testing using the canned test requests outlined in the programming guides.

---

Showing messages 1 through 4 of 4.

Return to weblogs.oreilly.com.