0
votes
1answer
134 views

Force download files protected with auth headers

By several REST clients the credentials are sent with every request through custom HTTP authorization headers to the REST service. Is there a way to force file download in the browser when accessing ...
1
vote
0answers
187 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
1
vote
2answers
283 views

REST security standards

As far as I know, SOAP services have security standards recognized by OASIS and W3C, such as: XML-Encryption XML-Signature SAML Are there any security standards for RESTful services?
1
vote
1answer
103 views

Is this where a nonce comes into play?

I'm reviewing a website a friend developed, and was looking for general errors and concerns. In reviewing I noticed he is very heavy on ajax calls using JSON to a RESTful API that he maintains on a ...
2
votes
1answer
2k views

Authenticating Users from Android with PHP Webservice

I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice. But I'm a little confused over the authentication scheme. I ...
-1
votes
2answers
103 views

Executing PHP WeService script by clicking a link within an e-mail

I'm receiving e-mail from my PHP/MySQL application with certain links. I was thinking on including an UUID as part of the link, which would point to a Web Service that ONLY reads those UUIDs. Those ...
0
votes
1answer
149 views

Does a malicious android WebView break the DoubleSubmittCookie countermeasure against CSRF?

Initial situation: A RESTful webservice defends against CSRF attacks by using the double submit cookie approach. This means that the authentication token gets submitted twice and verified at the ...
4
votes
2answers
692 views

XSS prevention for RESTful services

A RESTful service is currently protected against XSS attacks by applying XML schema- and entity validation. In both cases this is done via a regular expression like: <xs:pattern ...
4
votes
1answer
827 views

CSRF prevention for RESTful services

Am I right If I claim on that there doesn't exist any reliable protection against CSRF for a stateles environment today? I have a RESTful service (build with RESTEasy) that needs to be secured against ...
5
votes
1answer
232 views

Custom web authentication scheme

For a project at work I'm currently implementing a not too large webservice. For reasons of learning something new I tried making it a REST service, which then prompted the issue of authentication. I ...
-3
votes
1answer
357 views

Security of web services (REST & SOAP) [closed]

I'm doing a state of the art on web services security. I need every bit of a solution out there that solves concerns about identification, access control, transmission related ones like data ...
2
votes
1answer
100 views

Best practices for setting up client connections to a server with app credentials

The question title is... ugly to say the least. Here's an overview of what I've got: I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back. ...
0
votes
2answers
95 views

Why do services like Twitter have tokens and secrets for 3rd party apps?

I noticed that if you have a 3rd-party Twitter app, you get an access token, and an access token secret, to communicate with Twitter. Why are there two codes? Shouldn't one be enough? Does this mean ...
10
votes
6answers
10k views

Securing an API for mobile access

I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
0
votes
1answer
364 views

Web Service Security

We are currently designing a Web Service that returns a JSON formatted messages. The following are the planned implementation for the service's security: An SSL Certification to the service for the ...
9
votes
3answers
2k views

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
15
votes
1answer
2k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...