The tag has no usage guidance.

learn more… | top users | synonyms

2
votes
2answers
44 views

Assuring Client is Authorized to use JSON Web Token

JSON Web Tokens ( JWT ) are server-signed objects that the issuing server uses to identify a user, track session data and authorize requests. The fact that JWT are server-signed gives assurance that ...
1
vote
1answer
50 views

Choosing token over Session or vice versa?

I wanted to build a secure user interaction to the server, but I stumbled upon using either token or session. Here are couple of options that I thought about: I learned JWT, built a token, and send ...
2
votes
1answer
80 views

Randomly generated token vs JSON web token

I'm trying to secure access to my web server. I have been implementing a JSON web token authentication where I randomly generate a secretkey and associate it with that user. The secretkey will then ...
1
vote
1answer
103 views

Request signing for REST API

I am building a REST API that will receive requests like: GET /api/entities GET /api/entities?filter=X&sort=Y This seems straight forward: have the client HMAC(path + query, key), send me a key ...
2
votes
1answer
216 views

Is there a benefit of using stateless JWT over SHA256 hash for API tokens?

Does it make sense to use stateless JWT (without persistent storage) over plain SHA256? Example scenario: User logs in User token generated as follows: a. JWT.encode(userId, 'secret') or b. ...
2
votes
2answers
190 views

token based authentication attacks

JSON Web Token seems to be a very good tool to authenticate users. But I wonder if an attacker can take the token used by another user and use it for his own attacks. And to be more precise what makes ...
1
vote
1answer
308 views

JSON Web Tokens - How to securely store the key?

I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The concept core of this method is that the server is the only ...
0
votes
1answer
128 views

JSON and form-urlencoded encoded payloads in Burp Intruder

The application I'm running a security assessment on encodes POST requests as follows: POST /foo/save HTTP/1.1 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: ...
3
votes
1answer
215 views

How is JWT implemented?

I'm using django-rest-framework-jwt in one of my APIs. As you might know, the concept is simple: you send username and password and you get a token back. The token is not stored anywhere on the ...
0
votes
1answer
158 views

Is it valid to have more than 1 <saml:assertions> in a SAML Token response

I am trying to provide compatibility between an existing SAML token system with JWT token schema. The current system generates SAML tokens with a structure as follows: Is it even valid to have more ...
1
vote
1answer
1k views

ADFS 2012 R2 (3.0) JSON web token validation

Our client would like for us to utilize ADFS 2012 R2 (aka 3.0) as the primary means for two security features in internal apps that we are building: The web app (there are two .NET & Angular) ...
3
votes
1answer
234 views

REST API stateless authentication using social login

I am implementing a REST API for our mobile applications in which user will login using the SDKs of various social media. Currently, the login strategy is as follows: The token(s) (access_token in ...
5
votes
2answers
1k views

Securing a multi-tenant, multi-database REST API

I am looking to improve the security of an existing REST API accessed over SSL. The web service is multi-tenant, such that each tenant has an assigned TenantId. The problem I facing can be summarized ...
2
votes
1answer
369 views

Sending data from Android client to database

I have created an Android app which sends data to a web service (wcf). Right now the user sends his test result (test id, test name, test time and user ID. The problem is that I send the data from the ...
3
votes
1answer
209 views

How secure is HMAC

I'm a building a RESTful stateless API and I'm using a token for authentication. The problem I'm having is I'm not sure how secure HMAC is. I'm using a JSON Web Token library that let's me encrypt ...
1
vote
1answer
291 views

Is XSS prevention only on the frontend enough for JSON services? [duplicate]

We have an application with a form where user can enter a comment. The form is submitted using AJAX. Values are read also through AJAX and returned by the backend as JSON, and then parsed by ...
1
vote
3answers
242 views

OAuth2 vs. JSON authentication

1) To what extent is OAuth2 more secure than JSON authentication (both over SSL)? The context is a client (one server) querying another server (via API) within a local network using RESTFul. Prior to ...
2
votes
1answer
749 views

Can I prevent a replay attack of my signed JWTs?

I have implemented a stateless auth over HTTP in Laravel, using JWTs. I send my username/password from the frontend. Server authenticates user, sends back a signed JWT with an expiry time. I'm ...
9
votes
1answer
4k views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
-1
votes
2answers
128 views

How to prevent accessing secure cross-domain data store

I have a client that needs to be able to secure a data site from hackers. This is the methodology we currently are looking at: server.com (web server) —> HTTP JSON API request —> dataStore.net (data ...
2
votes
2answers
2k views

Securing JSON data

I am planning to use JSON as the data transport mechanism between my iOS app and my server (the server is a WCF service). While learning about JSON, I realized that all the data is passed around ...
0
votes
1answer
118 views

Is this signature methodology secure?

I'm working on authentication for my JSON-RPC API and my current working strategy is using signed requests sent via POST over SSL. I'm wondering if anyone can see any vulnerabilities that I haven't ...
0
votes
4answers
2k views

How to protect JSON [closed]

Hi i am working with JSON. I want to protect my JSON . I am getting JSON on the User Interface side by a service call using a Jquery. Is there some mechanism by which the JSON which i am returning ...
1
vote
0answers
272 views

Preventing access to my public REST api from my trusted client application

I own a set of REST APIs and some of them don't require users to be authenticated. Example could be: api/items/index of an e-commerce". Currently, I use Cookie-based tokens from my application, but ...
2
votes
1answer
656 views

How to Protect JSON Data [closed]

Hi I am using JSON on User Interface side. I want to protect that data. What are the possible ways I can protect my JSON. I have a scenario where I am having JSON Object with data on User Interface ...
4
votes
1answer
853 views

Does returning `Access-Control-Allow-Origin: *` weaken the security of JSON GET responses?

The W3C CORS recommendation states: Certain types of resources should not attempt to specify particular authorized origins, but instead either deny or allow all origins. ... 3. A GET ...
2
votes
4answers
327 views

Securing JSON? Is it justifiable to return html code instead of json to prevent copy cat?

In one website I had to manually enter first hand data, which is a really tiresome job. I am concerned if I return such data in json, it would be too easy to parse and incorporate into other's ...
8
votes
1answer
2k views

Designing single-sign-on with JSONP/CORS?

I like the way that OAuth/OpenID can authenticate/identify a user from another domain, but only if the other domain allows it (presumably on the user's instructions). I would like to do something ...
5
votes
2answers
3k views

Symmetric or asymmetric encryption for JSON Web Token?

We're planning on using JSON Web Tokens (JWT) for our authentication server, and I am currently evaluating which encryption approach to take for the JWE token. There appear to be two options for ...
3
votes
2answers
2k views

Is XSS possible here? Challenge

Is possible to bypass my regex and execute any javascript? <script> function json(a){ if (/^\s*$/.test(a) ? 0 : /^[\],:{}\s\u2028\u2029]*$/.test(a.replace(/\\["\\\/bfnrtu]/g, ...
5
votes
1answer
5k views

How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?

I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
16
votes
3answers
5k views

Security risks with JSONP?

What are the security risks with JSONP? Is using JSONP in a new web application reasonable, from a security perspective, or is it better to use a different method for cross-origin web mashups? If ...
5
votes
2answers
4k views

How can I prevent reflected XSS in my JSON web services?

I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response. This is open to XSS if the response is rendered as HTML by the browser since someone ...
3
votes
3answers
3k views

XSS : Content-type: application/json

Background information - Application responds to request to a particular URL with content-type: application/json JSON response contains a parameter from the request Escapes the quote with a slash ...
2
votes
2answers
4k views

Is this JSON encoding vulnerable to CDATA injection?

I ran across an odd notation in the jsfiddle.net generated pages <script type='text/javascript'>//<![CDATA[ $(window).load(function(){ $('form, table').animate({ opacity: 1 }); ...
12
votes
2answers
8k views

CSRF With JSON POST

I am playing around with a test application which accepts JSON requests and response is also JSON. I am trying to do a CSRF for a transaction which accepts only JSON data with POST method in request. ...
27
votes
3answers
13k views

How should web app developers defend against JSON hijacking?

What is the best defense against JSON hijacking? Can anyone enumerate the standard defenses, and explain their strengths and weaknesses? Here are some defenses that I've seen suggested: If the ...