An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

learn more… | top users | synonyms

3
votes
2answers
85 views

Sending non-expiring access token on each request vs using refresh tokens?

When securing REST APIs for mobile applications, what you often see is the use of refresh tokens. They exist because: Access Tokens have expiration date. We don't want the user to have to enter his ...
2
votes
2answers
418 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
7
votes
1answer
108 views

How the AWS signature works in depth

I'm trying to understand how the AWS signature 4 works. I read the docs and I found a Python example where a signature is computed. I also ran into this answer which explains HMAC a bit. I'm curious ...
0
votes
1answer
30 views

REST API security mobile application with PIN

I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved). As part of the login flow we have been instructed to ...
0
votes
1answer
130 views

Designing and implementing a secure epayments system with RESTful API

I want to design and implement an epayments system (I will not be handling credit card payments). The system will have a RESTful API. I am already familiar with RESTful servies, and have built a few ...
3
votes
0answers
946 views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...
2
votes
0answers
105 views

Securing a JavaScript app with RESTful backend

I went through the question Securing a JavaScript Single Page App with RESTful backend that has discussions / options around securing a Javascript client side app that invokes RESTful APIs. However, ...
2
votes
0answers
64 views

Cross Origin Resource Sharing question

I have some mockup html/javascript on my desktop, I made an ajax GET call to: http://www.bungie.net/platform/Destiny/TigerPSN/Account/4611686018429149347/Character/2305843009215132906/Activities/ ...
2
votes
0answers
930 views

Safe communication via rest api between two known servers

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
2
votes
0answers
1k views

Security instructions for a mobile banking REST API

I am designing a .NET Web API-based REST API that would be accessed via a mobile banking-like app. We plan to use OAuth 2.0 Resource Owner flow for authorization. All requests will go through HTTPS ...
1
vote
0answers
46 views

Vulnerabilities of using a token based authentication such as this

I'm developing a backend REST API for one of my mobile apps. I'm looking to create a token-based authentication system that would allow for a persistent login and I'm wondering if there are any ...
1
vote
0answers
37 views

Securing promotional discounts

I have a service, offering a physical good in exchange for either money or via code given out by us. The service is accessed through a mobile application. The codes have usage restrictions, for ...
1
vote
0answers
44 views

Securing ASP.net web api (REST)

I am developing a middle-ware web service app(REST) using asp.net mvc-4 web api. The rest services are consumed by android,ios,angularjs client apps.Same user is able to use multiple platforms at the ...
1
vote
0answers
58 views

How to authorize users for rest service

me and my friend are doing a project for a company. It involves getting some information from the database and display it on a smartglass device (epson, sony, ...). Now we want to build a RESTful ...
1
vote
0answers
1k views

Codeigniter RESTful web api creation for mobile and web applications general guidelines

I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
1
vote
0answers
386 views

Secure Single Page Application (SPA) served from a CDN

Is it possible to secure a Single Page Application (SPA) served from a CDN that communicates with a REST API, assuming the following: The front end communicates with a backend REST API using a token ...
1
vote
0answers
345 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
1
vote
0answers
646 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
408 views

Preventing access to my public REST api from my trusted client application

I own a set of REST APIs and some of them don't require users to be authenticated. Example could be: api/items/index of an e-commerce". Currently, I use Cookie-based tokens from my application, but ...
1
vote
0answers
2k views

Want to implement a really good authentication mechanism for REST API

I own a web application (single page application with Angular), that asks for some data through a set of REST APIs based on my server-side application (using Play Framework 2.2.1). So basically, I'm ...
1
vote
0answers
873 views

Securing REST API for use by mobile apps

I developed a REST API whose clients are mobile apps/websites under my control (API is not open to anyone). Users log into my mobile app/website with their Facebook or g+ login. I'd like to secure ...
1
vote
0answers
437 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
0
votes
0answers
5 views

Securing an error-reporting API against spamming

We are planning/spec'ing a REST API for communication with an iOS app an external team is building. For most calls, the API key hardcoded into the application and a session ID produced on our side ...
0
votes
0answers
91 views

OAUTH 2.0 Authorization Code flow and API key in Authorization header

We are creating Spring Boot REST services that registered third parties can use. We provided the third parties with a unique API key in JWT format, containing authorizations for that party to the ...
0
votes
0answers
39 views

Api key v oAuth for mobile apps

So we already have an oAuth setup for authenticating users. But there are endpoints that are not user specific that are currently open, we would like to restrict access to those open endpoints via API ...
0
votes
0answers
454 views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
0answers
103 views

How necessary is CAPTCHA (or similar) in REST APIs?

I'm currently implementing a REST API designed to be consumed by multiple platforms (iOS, Android, HTML5/Javascript), and I'm trying to protect my service and reduce (AWS) costs by preventing bots ...
0
votes
0answers
321 views

Secure REST API using Public/Private keys?

I was having a conversation with some programmer friends about securing an API without server modification. Only SFTP access to the filesystem is allowed and OpenSSL extension is installed, the admin ...
0
votes
0answers
128 views

Comparing Oauth and JWT auth in my web application

I have created an e-commerce website which has a REST API on the server side and Angular on the client side. I am considering to use OAuth to secure my API, but it seems to overkill because I have no ...
0
votes
0answers
230 views

OAuth - Facebook custom authorization grant

I've developed my own custom authorization grant. The steps I am undertaking are the following: I get the facebook authorization code from the mobile device (this is an an API for mobile devices) I ...
-1
votes
0answers
64 views

HMAC Signature Based authentication for REST APIs

We are building publicly available RESTful APIs for eCommerce where clients can place logistics requests with us. We want stateless authentication on these APIs. While on-boarding, every client will ...