SaaS Sign-in URL

Question

Referencing this question asked in this forum about URL Design for SSL-Secured SaaS Applications, and assuming Option C is used, whereby each account has unique subdirectory under Common Domain Name; the question is: for a SaaS application that deals with highly sensitive data (banking or medical records application) which is a better approach to designing an entry point to a client's sign-in page for a particular company:

1. Use a unique logical and keyable URL, for example for a company named ABC: https://saas.foobar.com/abc
2. Use a more cryptic url that relies on a company key as a URL parameter, for example: https://saas.foobar.com/login?companykey="232323355AAc"
3. Design the system to allow access using both above approaches, and allow the client to choose an approach that is consistent with the level of risk based on their own corporate security polices.

The trade-off using approach one verses approach two is simplicity over security. Additionally, is using approach one acceptable given that a guessed URL is potentially one less hoop a hacker has to jump through to gain access, and is possibly more vulnerable to social engineering practices?

Answer 1

You can offer a global login page that redirects users after authentication to the readable URL-path variant (something humans can read looks at least more trustworthy) - but always block access to the URL-path variant for requests without a valid session.

So you don't have to invest energy into some security to obscurity. You may think about additionally placing a web application firewall in front of your to-be-secured URLs.

(The companykey method btw. would have to be distributed somehow, via mail? It will be bookmarked and can't be easily remembered.)