Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the caller.

The api is only available though SSL 3.0 or TLS 1.0.

What are the main attacks which would be possible in this scenario?

The answer and comments to this SO question seem to indicate that if the risk of attack is proportionally low, more complexity will not improve security but will add complexity. I would like to know the highest risk areas for attack to determine the appropriate counter-measures, if necessary.

share|improve this question
add comment

migrated from stackoverflow.com Mar 14 '13 at 18:39

This question came from our site for professional and enthusiast programmers.

1 Answer

up vote 3 down vote accepted

This is a very broad question that can't be answered with anything near sufficiency on Stack Overflow. You really need to read a book to understand all of this. I highly recommend the Web Application Hacker's Handbook. It is an interesting and informative read.

Broadly speaking, you need to worry about people stealing or guessing the session ID. There are many different ways to do that. Make sure you are protected against XSS, CSRF, and that you are generating session IDs with sufficient entropy and randomness. Don't fall into the trap of using the current time value either. Those are surprisingly quite predictable.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.