Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality pre-made security modules like, for example, Rails' Devise, and thus I have to roll my own. I also think this is a very good learning opportunity, so why not.

The basic scenarios I need to have working are:

  • secure login through the web
  • login for mobile users using the same API
  • ACLs based on who the user is

Having never implemented any of the above by hand, I don't quite know the best practices. I've unfortunately been unable to find any good resources that would have tutorials/guides on how some of these basics form of web security are implemented.

For example, what is a good example of cookie-based authentication, what do you store in the token that's left on the user's browser etc etc. I've failed to uncover anything solid through Google, surprising given that it must be one of the most common implementations for most websites.

Advice?

Thank you!

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Most of the OWASP top 10 still applies to web services. A more detailed resource would be the Mozilla WebAppSec Guide.

"RESTful" web services should not have a "session token". Related: "Do sessions really violate RESTfulness?" However at the end of the day you need a some kind of token for authentication purposes.

In short, if you are writing a session handler to solve a real world problem you are doing it wrong. The last thing we need is yet another reinvention of the wheel. If you are writing a session handler for the purposes of education, then that is a great learning tool! The Mozilla WebAppSec Guide and the OWASP Session Management Cheat Sheet have detailed requirements for a secure session handler.

share|improve this answer
    
Those are all great links, thanks a bunch. Regarding your last paragraph, isn't it a matter of evaluating the cons and pros, based on the situation? For example, if you're using a somewhat obscure technology for implementing your web app, you pretty much have to roll you own session management. That's why I was hoping not to have to "reinvent the wheel" and instead follow the best practices out there to try to get to the same result, except implemented on my own. Yes, it might not be bank-bulletproof right away, but perhaps for certain low-importance data it might be acceptable? –  glitch May 3 '13 at 20:24
    
@glitch if such basic tools are not available then its probably not the right platform for a production system. –  Rook May 3 '13 at 20:57
    
Make sense, thank you for taking the time to write everything up! –  glitch May 3 '13 at 21:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.