An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

learn more… | top users | synonyms

1
vote
1answer
50 views

How secure is HMAC

I'm a building a RESTful stateless API and I'm using a token for authentication. The problem I'm having is I'm not sure how secure HMAC is. I'm using a JSON Web Token library that let's me encrypt ...
0
votes
0answers
36 views

Web Services Testing [closed]

I need to do security testing for RESTFUL web services. Are there any tools/checklists available? If so can someone help in sharing them as I don't much know about it. Also what are the details we ...
1
vote
1answer
62 views

What are the risks of protecting an API with one key only (without secret)?

I understand that a lot of APIs are protected using a (possibly public) API Key, to identify who is making the request, and a secret to hmac the parameters and determine if the client is actually who ...
0
votes
1answer
79 views

Improving stateless REST API authentication token - or ditch it for database persistence?

I'm looking to implement stateless REST authentication into an API. I've been reading up on articles here, and have implemented an idea that works, but I was hoping to get some feedback on its ...
1
vote
1answer
78 views

advantages of http basic authentication over token-based (e.g. oauth2)?

I am interested in the question if there are any possible advantages to securing a given REST API for web clients and mobile apps with http basic authentication (over https of course) over a ...
1
vote
0answers
33 views

Secure Single Page Application (SPA) served from a CDN

Is it possible to secure a Single Page Application (SPA) served from a CDN that communicates with a REST API, assuming the following: The front end communicates with a backend REST API using a token ...
3
votes
2answers
314 views

Secure REST API and Single Page App by using external OAuth 2 Authorization Code

I am trying to understand how to implement an OAuth 2 Authorization Code flow when having both a single page JS app and a REST API. The aim is to secure access to the REST API by offloading ...
2
votes
2answers
127 views

How can I secure my api to avoid copying?

Im building an app which should receive data from my server. The Api should be a PHP based script which provides the data as JSON. However I want to keep the data private and it should only be ...
0
votes
1answer
168 views

REST API: does securing the first call with a CAPTCHA make sense?

Let's say I have an iOS/Android app which rely on a custom REST API for things such as account management (register, login, password reset, get/set user-related data). There is no good way to ...
0
votes
0answers
111 views

Can I prevent a replay attack of my signed JWTs?

I have implemented a stateless auth over HTTP in Laravel, using JWTs. I send my username/password from the frontend. Server authenticates user, sends back a signed JWT with an expiry time. I'm ...
3
votes
1answer
285 views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
6
votes
2answers
649 views

Security concept for Android app with PHP based REST API

I'm trying to build my own PHP based REST Api for my Android app and I'm a litte bit confused by all the different user authentication stuff one can find on the internet. So I want to present my ...
0
votes
1answer
76 views

Designing and implementing a secure epayments system with RESTful API

I want to design and implement an epayments system (I will not be handling credit card payments). The system will have a RESTful API. I am already familiar with RESTful servies, and have built a few ...
3
votes
1answer
120 views

PUT vs. POST for password update

I am writing a User Management system that has to include a change of password utility. We don't front end hash passwords (hopefully we will soon). As a result passwords are passed over https in the ...
0
votes
0answers
110 views

How to secure my REST API once user authenticates with Google on mobile client?

In my application, I build REST APIs so that user can interact with my application server. Since I do not want to maintain User/Passwords, my iOS app authenticates client using Google. This all ...
0
votes
1answer
99 views

A no-login approach to authenticating a certain device, MAC-Address as password?

I have created a REST api, and now i'm thinking about authentication. I want the mobile application's flow for the user to be very simple: only having to enter a username and then this username ...
3
votes
2answers
58 views

Is letting just anybody see the appearance/html/javascript of your admin pages a security risk?

Ok so consider the scenario in which you have two projects, one is a RESTful API, and the other is a public facing website. The API uses cookie/token based authentication, and contains all of the ...
0
votes
0answers
80 views

OAuth - Facebook custom authorization grant

I've developed my own custom authorization grant. The steps I am undertaking are the following: I get the facebook authorization code from the mobile device (this is an an API for mobile devices) I ...
1
vote
3answers
132 views

How do I secure my REST api that is being accessed by only one application? [duplicate]

Suppose we have 2 webapps, appA and appB. They communicate via REST. Say for example, when appA updates let's say, a file, it should inform appB via REST and so on. I was thinking, how do I make ...
2
votes
4answers
133 views

Is CSRF possible if I don't even use cookies?

I have REST api that is using access token which is sent either in header or as url query. I don't use cookies at all. Am I still vulnerable to CSRF attacks? I know that I would if I would use ...
1
vote
2answers
134 views

Is it safe to skip CSRF checks for non-browsers?

I was in the middle of implementing a CSRF protection mechanism for my server when I realized that this attack only really affects web browsers. It got me wondering: why should I bother ...
0
votes
1answer
94 views

Using hashed password as secret key for hmac to avoid exchange of secret between server and client

I'm currently trying to improve our API to be more restful, therfore avoid any state on the server. I want to accomplish this with a hmac token, appended on every request. The hmac will be made with ...
0
votes
1answer
75 views

Mobile authentication

I'm currently working on an Android app in which I want to authenticate someone against an REST API. I want to do this as secure as is (cost-)effective/possible/userfriendly. I've been looking around ...
11
votes
4answers
715 views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As http://stackoverflow.com/a/15350123/14731 explains: The ...
0
votes
1answer
196 views

Force download files protected with auth headers

By several REST clients the credentials are sent with every request through custom HTTP authorization headers to the REST service. Is there a way to force file download in the browser when accessing ...
2
votes
1answer
314 views

HMAC secret key client storage

I've read numerous articles about using HMAC and the secret key for client authentication in a RESTful client (Javascript) application today. Still, I don't find a single source that is able to ...
5
votes
3answers
195 views

Secure a publicly accessible REST api

We're building a public single page app in JavaScript that talks to a back-end REST service. What we want is for that REST-service to be only accessible from the single page app. Since it's a public ...
4
votes
3answers
129 views

Preventive security action in Android App

Currently, I'm developing a bank related android app. I would share my knowledge and also maybe you guys are more expert than me so you can add your ideas to the list. Bank is a very special client. ...
1
vote
0answers
212 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
0
votes
2answers
389 views

Securing passwords for REST Authentication

first post on sec so go easy. I'm developing a REST application using the Spring Framework, as as part of the requirements, we have to secure the different functions of the system to different user ...
2
votes
1answer
251 views

REST security using only API key and SSL

I am looking to build a number of simple REST web services where: they only need to be called by server-side clients (i.e. no mobile/javascript/desktop) they are only accessible by HTTPS (no ...
1
vote
0answers
293 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
3
votes
1answer
465 views

Securing mobile app rest requests

I am using Facebook login in a mobile native app, and I'm trying to figure out if my approach is secure enough. This is the flow (all communication is made over SSL): User logins to Facebook ...
1
vote
2answers
353 views

REST security standards

As far as I know, SOAP services have security standards recognized by OASIS and W3C, such as: XML-Encryption XML-Signature SAML Are there any security standards for RESTful services?
2
votes
2answers
135 views

Securing internal REST service call via JavaScipt

I have a public Single Page Application (SPA) that is calling my backend REST service via JavaScript. How can I secure the REST service so that it will only accept calls from my SPA and no other ...
1
vote
1answer
449 views

Is this API Token scheme secure enough

I am designing a REST Api for a mobile application and have some worries over properly securing access to accounts. I am writing the API server in nodeJS and it will primarily be consumed by a mobile ...
3
votes
1answer
504 views

How to secure my REST implementation for an ember.js app

I've been searching and searching for what seems days and have not come up with any definitive answer on a solution to my problem. To explain without going into terrible detail I am building a store, ...
2
votes
1answer
1k views

HMAC solution for a rest API

I'm trying to learn some things about REST apis and one of the topics that I'm having some trouble is security. I'm using angularjs for web interface ans slim framework for the php api. I've read ...
1
vote
0answers
115 views

Preventing access to my public REST api from my trusted client application

I own a set of REST APIs and some of them don't require users to be authenticated. Example could be: api/items/index of an e-commerce". Currently, I use Cookie-based tokens from my application, but ...
1
vote
1answer
119 views

Is this where a nonce comes into play?

I'm reviewing a website a friend developed, and was looking for general errors and concerns. In reviewing I noticed he is very heavy on ajax calls using JSON to a RESTful API that he maintains on a ...
4
votes
1answer
735 views

Does it make sense to implement OAuth when no 3rd party is involved

I own a REST API at server side and a distinct web application that would call those APIs. I want to secure my APIs calls. After some reading, I want to implement the OAuth 1.0a mechanism at server ...
1
vote
0answers
678 views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
2
votes
1answer
2k views

Authenticating Users from Android with PHP Webservice

I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice. But I'm a little confused over the authentication scheme. I ...
0
votes
1answer
85 views

cURL and custom Rest API authentication exposure

I'm developing an API which is planned to use simple user and password authentication mode. I have experience with HTTP requests and tended to think everything as HTTP request. As user name and ...
21
votes
2answers
11k views

JSON Web Tokens (JWT) as user identification and authentication tokens

I'm implementing a REST service that requires authentication. I cannot store any per-user state (such as a randomly-generated token) because my service does not have direct access to a database, only ...
1
vote
1answer
378 views

RESTful API URLs and Denial Of Service attacks

I overheard the following statement today: We shouldn't use /api (e.g. in a RESTful URL like /api/v1/users/get) in our RESTful URLs anymore because it makes it easier for people to Denial Of ...
3
votes
1answer
314 views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
-1
votes
2answers
110 views

Executing PHP WeService script by clicking a link within an e-mail

I'm receiving e-mail from my PHP/MySQL application with certain links. I was thinking on including an UUID as part of the link, which would point to a Web Service that ONLY reads those UUIDs. Those ...
0
votes
1answer
343 views

Custom rest api / client security scheme

Right off the bat, I'd like to know if there is a widely used library or standard that I could adopt to replace my "custom" scheme. I am certain that I, as one person, cannot produce something better ...
0
votes
2answers
213 views

Does a simple mobile REST API need HTTPS?

Let's say I have a really simple mobile app with a server API. For example some kind of Q&A app, where users answer questions to win some points ('Who wants to be a Millionaire' kind of game). ...