The tag has no wiki summary.

learn more… | top users | synonyms

1
vote
1answer
36 views

Request signing for REST API

I am building a REST API that will receive requests like: GET /api/entities GET /api/entities?filter=X&sort=Y This seems straight forward: have the client HMAC(path + query, key), send me a key ...
2
votes
1answer
49 views

Is there a benefit of using stateless JWT over SHA256 hash for API tokens?

Does it make sense to use stateless JWT (without persistent storage) over plain SHA256? Example scenario: User logs in User token generated as follows: a. JWT.encode(userId, 'secret') or b. ...
2
votes
2answers
79 views

token based authentication attacks

JSON Web Token seems to be a very good tool to authenticate users. But I wonder if an attacker can take the token used by another user and use it for his own attacks. And to be more precise what makes ...
1
vote
1answer
64 views

JSON Web Tokens - How to securely store the key?

I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The concept core of this method is that the server is the only ...
0
votes
1answer
56 views

JSON and form-urlencoded encoded payloads in Burp Intruder

The application I'm running a security assessment on encodes POST requests as follows: POST /foo/save HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: ...
3
votes
1answer
89 views

How is JWT implemented?

I'm using django-rest-framework-jwt in one of my APIs. As you might know, the concept is simple: you send username and password and you get a token back. The token is not stored anywhere on the ...
0
votes
1answer
80 views

Is it valid to have more than 1 <saml:assertions> in a SAML Token response

I am trying to provide compatibility between an existing SAML token system with JWT token schema. The current system generates SAML tokens with a structure as follows: Is it even valid to have more ...
0
votes
1answer
601 views

ADFS 2012 R2 (3.0) JSON web token validation

Our client would like for us to utilize ADFS 2012 R2 (aka 3.0) as the primary means for two security features in internal apps that we are building: The web app (there are two .NET & Angular) ...
3
votes
1answer
155 views

REST API stateless authentication using social login

I am implementing a REST API for our mobile applications in which user will login using the SDKs of various social media. Currently, the login strategy is as follows: The token(s) (access_token in ...
4
votes
2answers
547 views

Securing a multi-tenant, multi-database REST API

I am looking to improve the security of an existing REST API accessed over SSL. The web service is multi-tenant, such that each tenant has an assigned TenantId. The problem I facing can be summarized ...
0
votes
0answers
210 views

sending data from android client to database

I have created an android app which sends data to a web service (wcf). Right now the user sends his test result (test id, test name, test time and user ID) the problem is I that i send the data from ...
3
votes
1answer
144 views

How secure is HMAC

I'm a building a RESTful stateless API and I'm using a token for authentication. The problem I'm having is I'm not sure how secure HMAC is. I'm using a JSON Web Token library that let's me encrypt ...
1
vote
1answer
196 views

Is XSS prevention only on the frontend enough for JSON services? [duplicate]

We have an application with a form where user can enter a comment. The form is submitted using AJAX. Values are read also through AJAX and returned by the backend as JSON, and then parsed by ...
0
votes
3answers
155 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
2
votes
1answer
524 views

Can I prevent a replay attack of my signed JWTs?

I have implemented a stateless auth over HTTP in Laravel, using JWTs. I send my username/password from the frontend. Server authenticates user, sends back a signed JWT with an expiry time. I'm ...
7
votes
1answer
3k views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
-1
votes
2answers
110 views

How to prevent accessing secure cross-domain data store

I have a client that needs to be able to secure a data site from hackers. This is the methodology we currently are looking at: server.com (web server) —> HTTP JSON API request —> dataStore.net (data ...
2
votes
2answers
2k views

Securing JSON data

I am planning to use JSON as the data transport mechanism between my iOS app and my server (the server is a WCF service). While learning about JSON, I realized that all the data is passed around ...
0
votes
1answer
102 views

Is this signature methodology secure?

I'm working on authentication for my JSON-RPC API and my current working strategy is using signed requests sent via POST over SSL. I'm wondering if anyone can see any vulnerabilities that I haven't ...
0
votes
4answers
1k views

How to protect JSON [closed]

Hi i am working with JSON. I want to protect my JSON . I am getting JSON on the User Interface side by a service call using a Jquery. Is there some mechanism by which the JSON which i am returning ...
1
vote
0answers
236 views

Preventing access to my public REST api from my trusted client application

I own a set of REST APIs and some of them don't require users to be authenticated. Example could be: api/items/index of an e-commerce". Currently, I use Cookie-based tokens from my application, but ...
2
votes
1answer
571 views

How to Protect JSON Data [closed]

Hi I am using JSON on User Interface side. I want to protect that data. What are the possible ways I can protect my JSON. I have a scenario where I am having JSON Object with data on User Interface ...
4
votes
1answer
755 views

Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
2
votes
4answers
280 views

Securing JSON? Is it justifiable to return html code instead of json to prevent copy cat?

In one website I had to manually enter first hand data, which is a really tiresome job. I am concerned if I return such data in json, it would be too easy to parse and incorporate into other's ...
8
votes
1answer
2k views

Designing single-sign-on with JSONP/CORS?

I like the way that OAuth/OpenID can authenticate/identify a user from another domain, but only if the other domain allows it (presumably on the user's instructions). I would like to do something ...
5
votes
2answers
2k views

Symmetric or asymmetric encryption for JSON Web Token?

We're planning on using JSON Web Tokens (JWT) for our authentication server, and I am currently evaluating which encryption approach to take for the JWE token. There appear to be two options for ...
3
votes
2answers
2k views

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
4
votes
1answer
3k views

How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?

I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
14
votes
3answers
4k views

Security risks with JSONP?

What are the security risks with JSONP? Is using JSONP in a new web application reasonable, from a security perspective, or is it better to use a different method for cross-origin web mashups? If ...
5
votes
2answers
4k views

How can I prevent reflected XSS in my JSON web services?

I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response. This is open to XSS if the response is rendered as HTML by the browser since someone ...
3
votes
3answers
2k views

XSS : Content-type: application/json

Background information - Application responds to request to a particular URL with content-type: application/json JSON response contains a parameter from the request Escapes the quote with a slash ...
2
votes
2answers
4k views

Is this JSON encoding vulnerable to CDATA injection?

I ran across an odd notation in the jsfiddle.net generated pages <script type='text/javascript'>//<![CDATA[ $(window).load(function(){ $('form, table').animate({ opacity: 1 }); ...
11
votes
2answers
7k views

CSRF With JSON POST

I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
25
votes
3answers
11k views

How should web app developers defend against JSON hijacking?

What is the best defense against JSON hijacking? Can anyone enumerate the standard defenses, and explain their strengths and weaknesses? Here are some defenses that I've seen suggested: If the ...