An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

learn more… | top users | synonyms

0
votes
0answers
4 views

Securing an error-reporting API against spamming

We are planning/spec'ing a REST API for communication with an iOS app an external team is building. For most calls, the API key hardcoded into the application and a session ID produced on our side ...
4
votes
3answers
592 views

Is conveying patient MRN in a web service URL a HIPAA PHI violation?

I'm building a web service to access patient data within our EMR and would like to subscribe to RESTful design principles. However, the idea of including the patient MRN in a GET request makes me ...
2
votes
1answer
36 views

Best practices for relatively simple API for our clients

I've been reading a lot about many API security considerations, the differences in terminology, OAUTH, OpenID, etc. Although I understand their absolute necessity when it comes to securing an API ...
2
votes
3answers
2k views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img ...
2
votes
2answers
302 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
4
votes
1answer
38 views

REST and confidential state - the trusted client problem etc?

With REST client sessions are not handled by maintaining server side state. Any such state needed for subsequent calls is passed to the client and then passed back to the server as part of those ...
1
vote
0answers
21 views

Securing ASP.net web api (REST)

I am developing a middle-ware web service app(REST) using asp.net mvc-4 web api. The rest services are consumed by android,ios,angularjs client apps.Same user is able to use multiple platforms at the ...
55
votes
4answers
55k views

How do I secure my REST API?

In detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After searching with Google for a ...
14
votes
3answers
7k views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
15
votes
3answers
11k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
1
vote
2answers
46 views

Using mutual authentication, should I still worry about message integrity and replay attack?

I'm trying to secure a REST API, our situation is that every client connecting to this API will also have a certificate signed by our own CA. Because of this, I think we can use the client certificate ...
1
vote
1answer
73 views

SSL MITM attack vectors for server to server HTTPS using an untrusted certificate?

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default. What are obvious attack vectors for MITMing a server-to-server HTTPS communication ...
0
votes
1answer
63 views

Attack vectors for server to server using untrusted HTTPS certificates? [closed]

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default. For example, from the documentation for node's request: strictSSL - If true, ...
0
votes
0answers
59 views

OAUTH 2.0 Authorization Code flow and API key in Authorization header

We are creating Spring Boot REST services that registered third parties can use. We provided the third parties with a unique API key in JWT format, containing authorizations for that party to the ...
3
votes
3answers
157 views

Risks of securing REST API using SSL?

We are thinking of building a REST API where all calls are over SSL. After successful login subsequent calls will include a token which was returned by the login service. The server will validate ...
4
votes
2answers
171 views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
0
votes
0answers
35 views

Api key v oAuth for mobile apps

So we already have an oAuth setup for authenticating users. But there are endpoints that are not user specific that are currently open, we would like to restrict access to those open endpoints via API ...
1
vote
0answers
54 views

How to authorize users for rest service

me and my friend are doing a project for a company. It involves getting some information from the database and display it on a smartglass device (epson, sony, ...). Now we want to build a RESTful ...
0
votes
0answers
420 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
1answer
146 views

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

While working on a project that used the REST API for Gerrit Code Review I noticed that they do something that I thought was strange Source: To prevent against Cross Site Script Inclusion (XSSI) ...
0
votes
0answers
78 views

How necessary is CAPTCHA (or similar) in REST APIs?

I'm currently implementing a REST API designed to be consumed by multiple platforms (iOS, Android, HTML5/Javascript), and I'm trying to protect my service and reduce (AWS) costs by preventing bots ...
0
votes
1answer
55 views

How to prevent unintended REST API usage?

For a university project, I am supposed to implement an API that allows storage and retrival of strings. Clients accessing this api can be mobile phone apps and low power embedded devices. The data ...
1
vote
1answer
84 views

Secure communication between two REST apis

I'm building an application which stands alone for the most part, but which needs to access another system for private user data. What is a simple and safe method of securing that private data? We ...
1
vote
3answers
66 views

API Method Parameter Enumeration via Web Browser

I am obligated by contract to prevent enumeration of an API method's parameters but cannot achieve it. When I send a blank request to the API server in a web browser, the server responds with the ...
6
votes
1answer
2k views

JWT token login and logout

Hi I am creating mobile native application that uses REST API endpoints to communicate with server side. I have had previous experience developing native clients, but I have simple token (random ...
0
votes
1answer
93 views

How to store a token of a restful API?

It's a basic question, but I see in a lot of tutorials of authentication in restful webservices that some user goes to a website and register yourself with an ID and a password, after this ...
4
votes
2answers
2k views

Can I prevent a replay attack of my signed JWTs?

I have implemented a stateless auth over HTTP in Laravel, using JWTs. I send my username/password from the frontend. Server authenticates user, sends back a signed JWT with an expiry time. I'm ...
0
votes
1answer
120 views

Exploiting CSRF PUT request

If the application uses RESTful communication, does it need to have CSRF protection for PUT and DELETE requests? As per my understanding its not possible to trigger a PUT request using JavaScript and ...
1
vote
2answers
1k views

Improving stateless REST API authentication token - or ditch it for database persistence?

I'm looking to implement stateless REST authentication into an API. I've been reading up on articles here, and have implemented an idea that works, but I was hoping to get some feedback on its ...
3
votes
1answer
32 views

Adding HTTPS API to legacy hardware system that uses short numeric passwords

I work with a hardware system that traditionally authenticates users by the entry of a short numeric password on a physical keypad. Despite the small password entropy, this system has proven to be ...
0
votes
0answers
245 views

Secure REST API using Public/Private keys?

I was having a conversation with some programmer friends about securing an API without server modification. Only SFTP access to the filesystem is allowed and OpenSSL extension is installed, the admin ...
6
votes
0answers
74 views

How the AWS signature works in depth

I'm trying to understand how the AWS signature 4 works. I read the docs and I found the Python example where a signature is computed ...
2
votes
1answer
74 views

How to save passwords temporarily?

I work for a hosting company and are about to design a rest api for a 3rd party so they can create Active Directory user accounts. I also want this api to be async and robust enough to survice ...
4
votes
3answers
205 views

Can OAuth2 help to authenticate the app?

We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API. We assume ...
2
votes
2answers
6k views

Securing passwords for REST Authentication

I'm developing a REST application using the Spring Framework, as as part of the requirements, we have to secure the different functions of the system to different user roles (pretty standard stuff). ...
0
votes
1answer
183 views

Does certificate pinning protect against Fiddler?

We have a mobile app that connects to our server via RESTful HTTPS web services. We also have an attacker who correctly emulates our app in communicating with our server. We therefore assume that our ...
4
votes
1answer
277 views

Ouath2 how does it work (Android client)

I have read a lot about Oauth2 but still cannot understand, how does it work. I will explain how do I understand this protocol. There are some main characters in Oauth protocol interaction. User, ...
0
votes
1answer
147 views

Is sharing a CSRF token between Rails apps secure?

We use an nginx reverse proxy to host two Rails apps under the same domain (one /path leads to another 'secondary' app). The 'secondary' app that lives under a path consumes REST APIs from the 'main' ...
1
vote
1answer
269 views

cURL and custom Rest API authentication exposure

I'm developing an API which is planned to use simple user and password authentication mode. I have experience with HTTP requests and tended to think everything as HTTP request. As user name and ...
4
votes
1answer
1k views

How to secure my REST implementation for an ember.js app

I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem. To explain without going into terrible detail I am building a store, ...
1
vote
3answers
314 views

Security RESTful web application in Java

We are developing two web applications: Application A : Restful web-services running on a GlassFish Server . Application B : Dynamic web application running on a Tomcat Server . I am accessing ...
3
votes
1answer
137 views

API which does not allow to invalidate session on server side - how to make it more secure?

I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like logout which will make the cookie my app is using be invalid from now on. ...
2
votes
1answer
257 views

Securing REST API without sending or storing clear credentials

We are currently designing a REST API, and thinking about securing it. Going through a lot of documentation, it has become clear that 2 options are available. HMAC Authentication By hashing with ...
3
votes
4answers
499 views

Securing REST API without HTTPS

I'm developing a REST API but I am unable to use HTTPS without using self-signed certificates. I understand that that might be acceptable for some, but I don't want security messages popping up on ...
0
votes
0answers
121 views

Comparing Oauth and JWT auth in my web application

I have created an e-commerce website which has a REST API on the server side and Angular on the client side. I am considering to use OAuth to secure my API, but it seems to overkill because I have no ...
1
vote
0answers
36 views

Is it necessary to add CSRF tokens for REST API? [duplicate]

I have a few REST APIs for an iPhone app. It has a login and session management functionality. Currently the session has been tracked by a token set during login. Are REST services affected by CSRF ...
1
vote
1answer
74 views

How to check randomness of a hash?

I have a REST api in which the server allots a unique token each time a user is logged in. Its a hash containing numbers,letters and a one or two special chars. I want to check the entropy of these ...
14
votes
4answers
7k views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As http://stackoverflow.com/a/15350123/14731 explains: The ...
53
votes
2answers
45k views

JSON Web Tokens (JWT) as user identification and authentication tokens

I'm implementing a REST service that requires authentication. I cannot store any per-user state (such as a randomly-generated token) because my service does not have direct access to a database, only ...
2
votes
2answers
172 views

Issuing secure tokens that doesn't require any server side state

The issue I am currently designing the backend for a SPA (Single Page Application), which I'm planning to construct in a fairly RESTful manner. The backend will ideally be just a thin layer between ...