0
votes
1answer
263 views

What mechanism to use for simple and secure HTTP API access?

I am currently working on a service which offers a HTTP API for mobile clients. I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be ...
2
votes
2answers
95 views

Actual issue? Phone switches from 3G to router makes session switch from https to http

I heard that a security issue exists in some cases when a mobile phone has: Connected to a website via https via 3G Connects to a router I'm told that that in this particular scenario the router ...
3
votes
3answers
640 views

Session fixation attack

Given the following conditions, Session ID does not change upon login Session ID travels in form of HTTP cookie There is no cross site scripting/redirection vulnerability on the login page is it ...