An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.
14
votes
5answers
4k views
SSL with GET and POST
I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests?
For instance, if I have two requests
GET:
...
11
votes
1answer
1k views
REST specific security weaknesses
I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST.
What I would ...
11
votes
2answers
4k views
Securing a JavaScript Single Page App with RESTful backend
I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
10
votes
3answers
3k views
How do I secure my REST API?
In Detail here's the problem:
I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After googling for a while, I feel ...
10
votes
1answer
1k views
Best way to secure javascript front end/REST back end architecture web site?
I would like to build the following project:
public REST API back end which can be accessed by any authenticated client.
front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
9
votes
2answers
153 views
Is request signing (digesting the request body) in a REST API necessary?
I am currently engaged in a debate and I wondered what the community's opinion on this was.
We see REST APIs which just require basic authentication (perhaps HTTP) or OAuth.
We see REST APIs which ...
7
votes
3answers
999 views
Any flaws in this security model for a REST web service?
I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
6
votes
6answers
3k views
Securing an API for mobile access
I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
6
votes
2answers
100 views
Client authentication vs. user authentication
I am currently looking into authentication protocols which work well with REST API, in java.
There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
6
votes
2answers
205 views
An adequate message authentication code for REST
My REST service currently uses SCRAM authentication to issue tokens for callers and users.
Tokens issued by the SCRAM exchange have an expiry time after which a repeated sign-in is required. We also ...
5
votes
1answer
115 views
Why a symmetric key for HMAC?
I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard ...
4
votes
1answer
96 views
Resources/materials for implementing secure web services?
I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
4
votes
2answers
854 views
Security drawbacks for using short-lived access token in javascript client side
I intend to build a front end site entirely in javascript (NodeJS) and i would like to do ajax calls to a REST WS which is on another domain on client side.
I intend to use oauth2 and SSL to secure ...
3
votes
1answer
160 views
Custom EC2-style user authentication system - how secure is it?
At work I'm trying to design a user authentication system that is session-less (including session based tokens such as those used in OAuth2) due to client software requirements. The services are REST ...
2
votes
4answers
255 views
Why do APIs use API Keys instead of Usernames?
It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
2
votes
3answers
171 views
HMAC What is secure manner to distribute shared secret between client and server?
I am looking at ways to secure http communication using HMAC. My understanding is that in this scenario the client and the server both know a secret. This means the secret must be first generated on ...
2
votes
1answer
123 views
user/pass auth vs hmac signed for REST API
I know they both prevent the RESTful APIs from abuse. Hmac signed api is commonly used than the other. But I think using user/pass pair for authorization is more security, here's the reason:
To sign ...
2
votes
1answer
66 views
Best practices for setting up client connections to a server with app credentials
The question title is... ugly to say the least. Here's an overview of what I've got:
I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back.
...
1
vote
1answer
124 views
Basic Authentication with WebAPI and HTML/JS Client?
I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and ...
1
vote
2answers
177 views
Looking for feedback on my REST-style API authentication design and two-factor authentication
Authentication
The authentication is going to be signature-based. The signature will be generated using:
HMAC_SHA256(SHA1(secret_key) + '#' + request_data + '#' + utc_timestamp)
The utc_timestamp ...
1
vote
1answer
257 views
Multiple security layers for SOA REST intranet services
For intranet applications that already leverage Active Directory, is there any point or benefit to adding a second layer of security such as OAuth when accessing SOA REST services? We're new to SOA ...
1
vote
1answer
453 views
How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?
I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
0
votes
1answer
226 views
Web Service Security
We are currently designing a Web Service that returns a JSON formatted messages. The following are the planned implementation for the service's security:
An SSL Certification to the service for the ...
0
votes
2answers
61 views
Why do services like Twitter have tokens and secrets for 3rd party apps?
I noticed that if you have a 3rd-party Twitter app, you get an access token, and an access token secret, to communicate with Twitter.
Why are there two codes? Shouldn't one be enough?
Does this mean ...
0
votes
2answers
217 views
Securing anonymous accessible URL with a GUID segment?
In my problem there is an existing system that works as a alerting or clipping service that runs user defined searches and generates results lists. These are setup by authenticated users and this ...
-3
votes
1answer
65 views
Security of web services (REST & SOAP) [closed]
I'm doing a state of the art on web services security. I need every bit of a solution out there that solves concerns about identification, access control, transmission related ones like data ...
