An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

learn more… | top users | synonyms

0
votes
1answer
49 views

REST API security mobile application with PIN

I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved). As part of the login flow we have been instructed to ...
3
votes
0answers
53 views

Why isn't Amazon using a NONCE for REST Authentication?

When you look at Amazons RESTAuthentication you can see that it doesn't use a nonce: Authorization = "AWS" + " " + AWSAccessKeyId + ":" + Signature; Signature = Base64( HMAC-SHA1( ...
61
votes
6answers
60k views

How do I secure my REST API?

In detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After searching with Google for a ...
3
votes
0answers
34 views

Simple Authentication Method to Secure REST API

I've been desperately trying to find a simple method of securing my API but still haven't found one that works. Unlike a lot RESTful APIs my API doesn't need user logins, tokens that expire, or other ...
1
vote
3answers
146 views

Is hashing passwords with bcrypt and a constant salt more unsecure than SHA1?

I've built an API that allows users to submit encrypted data to be stored in the cloud. To retrieve their data, the API requires the user to supply only the MongoDB Object ID that they are given when ...
3
votes
2answers
485 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
4
votes
2answers
118 views

Sending non-expiring access token on each request vs using refresh tokens?

When securing REST APIs for mobile applications, what you often see is the use of refresh tokens. They exist because: Access Tokens have expiration date. We don't want the user to have to enter his ...
7
votes
1answer
120 views

How the AWS signature works in depth

I'm trying to understand how the AWS signature 4 works. I read the docs and I found a Python example where a signature is computed. I also ran into this answer which explains HMAC a bit. I'm curious ...
1
vote
2answers
33 views

Should a Web site be allowed to use a third party web service directly?

Imagine I have a web site running on an IIS. The web site needs to get/send sensitive data from a 3rd party REST web service. Is there any reason why a web site (server side, not client side) should ...
8
votes
1answer
215 views

How do you pen test a REST API?

We have a server that is running a REST API on port 443. I'd like to make sure it's secure by doing various pen tests on it. I'm used to doing offensive testing on a webpage where I can see code, and ...
1
vote
1answer
312 views

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

While working on a project that used the REST API for Gerrit Code Review I noticed that they do something that I thought was strange Source: To prevent against Cross Site Script Inclusion (XSSI) ...
1
vote
1answer
60 views

How to secure android REST basic authentication credentials against reverse engineering?

As far as I know, in basic REST API authentication, username and password to access web service resources are baked into the app's code. On the other hand, it seems not difficult to reverse engineer ...
59
votes
3answers
43k views

Securing a JavaScript Single Page App with RESTful backend

I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
3
votes
0answers
965 views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...
3
votes
1answer
177 views

Would this RESTful login system be secure?

So I have been thinking about a way to make a secure restful API for application logins. This is what my teacher and I have come up with: The Client (swift program) initializes the connection with ...
1
vote
0answers
67 views

Vulnerabilities of using a token based authentication such as this

I'm developing a backend REST API for one of my mobile apps. I'm looking to create a token-based authentication system that would allow for a persistent login and I'm wondering if there are any ...
1
vote
0answers
37 views

Securing promotional discounts

I have a service, offering a physical good in exchange for either money or via code given out by us. The service is accessed through a mobile application. The codes have usage restrictions, for ...
2
votes
1answer
38 views

Single Page Application with REST API backend based on XML, queried by dynamic XPath

A web application I'm developing will be a Single Page Application (SPA) that will interact with a REST API backend, through jQuery.ajax() calls. The SPA and API will both be served over an https/TLS ...
1
vote
0answers
9 views

Securing an error-reporting API against spamming

We are planning/spec'ing a REST API for communication with an iOS app an external team is building. For most calls, the API key hardcoded into the application and a session ID produced on our side ...
5
votes
3answers
750 views

Is conveying patient MRN in a web service URL a HIPAA PHI violation?

I'm building a web service to access patient data within our EMR and would like to subscribe to RESTful design principles. However, the idea of including the patient MRN in a GET request makes me ...
2
votes
1answer
45 views

Best practices for relatively simple API for our clients

I've been reading a lot about many API security considerations, the differences in terminology, OAUTH, OpenID, etc. Although I understand their absolute necessity when it comes to securing an API ...
2
votes
3answers
3k views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img src="http://api....
4
votes
1answer
43 views

REST and confidential state - the trusted client problem etc?

With REST client sessions are not handled by maintaining server side state. Any such state needed for subsequent calls is passed to the client and then passed back to the server as part of those calls....
1
vote
0answers
72 views

Securing ASP.net web api (REST)

I am developing a middle-ware web service app(REST) using asp.net mvc-4 web api. The rest services are consumed by android,ios,angularjs client apps.Same user is able to use multiple platforms at the ...
15
votes
3answers
8k views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
17
votes
3answers
12k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
1
vote
2answers
54 views

Using mutual authentication, should I still worry about message integrity and replay attack?

I'm trying to secure a REST API, our situation is that every client connecting to this API will also have a certificate signed by our own CA. Because of this, I think we can use the client certificate ...
1
vote
1answer
85 views

SSL MITM attack vectors for server to server HTTPS using an untrusted certificate?

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default. What are obvious attack vectors for MITMing a server-to-server HTTPS communication ...
0
votes
1answer
68 views

Attack vectors for server to server using untrusted HTTPS certificates? [closed]

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default. For example, from the documentation for node's request: strictSSL - If true, ...
0
votes
0answers
99 views

OAUTH 2.0 Authorization Code flow and API key in Authorization header

We are creating Spring Boot REST services that registered third parties can use. We provided the third parties with a unique API key in JWT format, containing authorizations for that party to the ...
3
votes
3answers
171 views

Risks of securing REST API using SSL?

We are thinking of building a REST API where all calls are over SSL. After successful login subsequent calls will include a token which was returned by the login service. The server will validate ...
4
votes
2answers
285 views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
0
votes
0answers
44 views

Api key v oAuth for mobile apps

So we already have an oAuth setup for authenticating users. But there are endpoints that are not user specific that are currently open, we would like to restrict access to those open endpoints via API ...
1
vote
0answers
61 views

How to authorize users for rest service

me and my friend are doing a project for a company. It involves getting some information from the database and display it on a smartglass device (epson, sony, ...). Now we want to build a RESTful ...
0
votes
0answers
468 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
112 views

How necessary is CAPTCHA (or similar) in REST APIs?

I'm currently implementing a REST API designed to be consumed by multiple platforms (iOS, Android, HTML5/Javascript), and I'm trying to protect my service and reduce (AWS) costs by preventing bots ...
0
votes
1answer
75 views

How to prevent unintended REST API usage?

For a university project, I am supposed to implement an API that allows storage and retrival of strings. Clients accessing this api can be mobile phone apps and low power embedded devices. The data ...
1
vote
1answer
134 views

Secure communication between two REST apis

I'm building an application which stands alone for the most part, but which needs to access another system for private user data. What is a simple and safe method of securing that private data? We ...
1
vote
3answers
78 views

API Method Parameter Enumeration via Web Browser

I am obligated by contract to prevent enumeration of an API method's parameters but cannot achieve it. When I send a blank request to the API server in a web browser, the server responds with the ...
8
votes
1answer
3k views

JWT token login and logout

Hi I am creating mobile native application that uses REST API endpoints to communicate with server side. I have had previous experience developing native clients, but I have simple token (random ...
0
votes
1answer
141 views

How to store a token of a restful API?

It's a basic question, but I see in a lot of tutorials of authentication in restful webservices that some user goes to a website and register yourself with an ID and a password, after this ...
6
votes
2answers
3k views

Can I prevent a replay attack of my signed JWTs?

I have implemented a stateless auth over HTTP in Laravel, using JWTs. I send my username/password from the frontend. Server authenticates user, sends back a signed JWT with an expiry time. I'm ...
0
votes
1answer
234 views

Exploiting CSRF PUT request

If the application uses RESTful communication, does it need to have CSRF protection for PUT and DELETE requests? As per my understanding its not possible to trigger a PUT request using JavaScript and ...
1
vote
2answers
1k views

Improving stateless REST API authentication token - or ditch it for database persistence?

I'm looking to implement stateless REST authentication into an API. I've been reading up on articles here, and have implemented an idea that works, but I was hoping to get some feedback on its ...
3
votes
1answer
34 views

Adding HTTPS API to legacy hardware system that uses short numeric passwords

I work with a hardware system that traditionally authenticates users by the entry of a short numeric password on a physical keypad. Despite the small password entropy, this system has proven to be ...
0
votes
0answers
335 views

Secure REST API using Public/Private keys?

I was having a conversation with some programmer friends about securing an API without server modification. Only SFTP access to the filesystem is allowed and OpenSSL extension is installed, the admin ...
2
votes
1answer
86 views

How to save passwords temporarily?

I work for a hosting company and are about to design a rest api for a 3rd party so they can create Active Directory user accounts. I also want this api to be async and robust enough to survice ...
4
votes
3answers
229 views

Can OAuth2 help to authenticate the app?

We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API. We assume ...
2
votes
2answers
7k views

Securing passwords for REST Authentication

I'm developing a REST application using the Spring Framework, as as part of the requirements, we have to secure the different functions of the system to different user roles (pretty standard stuff). ...
1
vote
1answer
275 views

Does certificate pinning protect against Fiddler?

We have a mobile app that connects to our server via RESTful HTTPS web services. We also have an attacker who correctly emulates our app in communicating with our server. We therefore assume that our ...