An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

learn more… | top users | synonyms

23
votes
6answers
12k views

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET: ...
11
votes
4answers
469 views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As http://stackoverflow.com/a/15350123/14731 explains: The ...
26
votes
4answers
20k views

How do I secure my REST API?

In Detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After googling for a while, I feel ...
37
votes
3answers
17k views

Securing a JavaScript Single Page App with RESTful backend

I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
15
votes
1answer
2k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
9
votes
3answers
2k views

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
6
votes
2answers
2k views

Security drawbacks for using short-lived access token in javascript client side

I intend to build a front end site entirely in javascript (NodeJS) and i would like to do ajax calls to a REST WS which is on another domain on client side. I intend to use oauth2 and SSL to secure ...
6
votes
3answers
350 views

Vulnerabilities with DB backed session tokens

A user logs in and is given a session token. This token is also stored in a database on the server. The user includes this secret token with each request, and the server will pull it from the DB to ...
1
vote
2answers
247 views

REST security standards

As far as I know, SOAP services have security standards recognized by OASIS and W3C, such as: XML-Encryption XML-Signature SAML Are there any security standards for RESTful services?