[gootik]

I don't think you're getting the point of the article. It is talking about dereferencing the STATE and the VALUE portions of a RESTful API. Not what's the most secure way of sending a credit card number over TCP/IP.

[webhat]

I got the point exactly, and the paragraph under the example states:

> The obvious problem with this is that we’re given a reference to the product, and not the product itself.

Which isn't the most obvious problem with this example.

You might want to read: https://www.owasp.org/index.php/REST_Security_Cheat_Sheet