A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

-3
votes
1answer
55 views

Google News, unencrypted by default- unless logged in? [on hold]

http://news.google.com Of course, if you are logged into a Google account, it is encrypted. Otherwise, unencrypted by default.. Even when visiting Google News via a Google search result page ...
0
votes
1answer
66 views

How secure are the passwords stored at Google Passwords? [closed]

It seems Google activated central place for storing app/website passwords which is accessible at https://passwords.google.com/ and all the remembered Chrome passwords are synched there. In what ...
-3
votes
3answers
66 views

What security problems are there with enabling directory listing on my webserver? [duplicate]

I want to to ensure that every file on my webserver is secured. The problems I am having right now: If you go to my website, and enter a url like mywebsite.com/img/ if there is no index page in ...
2
votes
0answers
29 views

Patterns for asynchronous authentication (after message is sent)

I'm looking at a scheme where users/servers post messages to each other. One of the main challenges is to prove "ownership" of a URL - defined as the ability to receive messages. This can be done ...
3
votes
2answers
302 views

Ways around browser xss detection

Most modern browsers will detect xss attempts (script code in the URL) and prevent execution. Are there any known standard ways around this or are xss attacks pretty much impossible now?
3
votes
4answers
63 views

How to avoid web service spam?

How can I restrict users from spamming my web service by sending thousands of requests? My web service is actually protected by a validation token only accessible through authentication, but I still ...
0
votes
0answers
52 views

Comparing Oauth and JWT auth in my web application

I have created an e-commerce website which has a REST API on the server side and Angular on the client side. I am considering to use OAuth to secure my API, but it seems to overkill because I have no ...
2
votes
2answers
113 views

Is writing to /dev/null secure?

I am working on a web-service based crypto project in JAVA. The basic idea is for the client to send a SOAP request to a servlet to encrypt data. For data transmission I am using MIME/data-handlers ...
-4
votes
2answers
60 views

How to ensure website from hackers and more? [closed]

I'm really new to security in Websites, for example... So can someone give me somewhere to start please? Sorry if it's not the right place to ask... :|
2
votes
0answers
38 views

Security implications of providing an encryption/decryption oracle

I need to provide a service that acts as a symetric encryption/decryption blackbox : the box get a secret key k users send datas d, and get ciphertext c = Encrypt(d,k) users send ciphertext c, and ...
0
votes
1answer
49 views

Control access to public API

I'm working on a public API for project X. System allows to register an app_id and call API methods providing it, as usual. Now, I need to develop an official mobile client for project X that should ...
1
vote
0answers
73 views

How to secure requests to my API from my web widget embedded in third party website

Background I'm designing a web widget for a new SaaS for embedding in a password-protected CMS. This would allow the customer to add something like the following to all the pages in their CMS to ...
4
votes
1answer
61 views

Where should a Vulnerability Disclosure Policy be published?

In 2014, the New Zealand Internet Task Force released a set of guidelines for Vulnerability Disclosure: http://www.nzitf.org.nz/pdf/NZITF_Disclosure_Guidelines_2014.pdf Part of the recommendations ...
4
votes
1answer
75 views

Purpose for “One Time Use Token”

I'm connecting a Salesforce ORG with a third party vender through a custom API (they basically wrote it just for us). The API requires you to retrieve a "token" that you pass into other calls through ...
0
votes
1answer
62 views

Choosing security scenario for WCF service/client hosted by IIS

I have web server (hosted using IIS) in DMZ hosts multiple web services (WCF), the clients are non-server applications (they are standalone .NET application) reaching these web services via internet ...
1
vote
1answer
631 views

How to exploit CRLF Injection?

I was running a few tests on a website when I came across this: Request: GET /accounts?intended_destination=internal_api%2Fcampaigns_dashboard%7Cshow&intended_params=format%3Dhtml HTTP/1.1 ...
1
vote
1answer
56 views

Is the security of this .net application flawed?

Ok, I know that every obfuscated .Net application can be reverse engineered. And I know that it is better if I go the open source way if possible. But unfortunately I cannot because there is no ...
5
votes
1answer
250 views

Showing bank routing/account numbers, and storing them safely

EDIT: This is for the UK/Europe region. I've been scratching my head reading other posts similar to this one about safely storing bank routing and account numbers. I know that routing numbers can be ...
0
votes
1answer
105 views

Bell-LaPadula model and composite services

The Bell-LaPadula model is useful for access control. Can I use this model for access control in composite services? The security level of each service is exported from WS_SecurityPolicy file.
3
votes
2answers
8k views

What is s3.amazonaws.com, and why is Chrome blocking it?

Lately, whenever I click on a download link in Google Chrome, it redirects to another link starting with s3.amazonaws.com, which in turn gets blocked either by Chrome or by my Antivirus (Comodo ...
0
votes
2answers
172 views

SQL Injection in a Web Service URL as a Parameter Value [closed]

Obviously SQL Injection via the payload of a message is a very common practice and therefore it is always key to cover this (I already have in my code). However I'm just wondering about how possible ...
1
vote
0answers
85 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
0
votes
1answer
109 views

Security tradeoffs while designing a mobile Web Service API

I'm not a security expert but I want to ask about tradeoffs in a web service API I'm designing for mobile apps. It is an API which tracks users' locations so yes, the data is reasonably sensitive. ...
1
vote
0answers
126 views

Is generating custom authentication token for WCF service requests a good practice?

I have public WCF web service which works over https. There are lots of technical restrictions on client side, so I can't use any advanced schemes like oauth. I have registered users and some of them ...
1
vote
1answer
132 views

Simple way to secure a webservice used by mobile clients

I am currently working on a RESTful webservice with Java that is used by mobile devices, namely Android and iOS, using a framework that allows me to abstract from both. I'm adding this information ...
2
votes
0answers
73 views

Correct approach to secure the back end service - oAuth

I'm developing a OAUTH service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants. basically users can purchase goods from Merchant's E-Commerce ...
0
votes
2answers
65 views

HTTPS in request and HTTP in response [closed]

If I have an API that calls a backend webservice, is it possible to use HTTPS in the request and just HTTP in the response? I have such a question because I want to protect my OAuth token in my ...
1
vote
0answers
175 views

Secure Requests Between iOS App and PHP Server

I'm developing an iOS app that requires data to be sent to a server to process a transaction. The data is stored on Stripe (A credit card service) so I do not need to worry about encrypting / storing ...
0
votes
2answers
149 views

How to block spammers from using my public email api

I am working on a web application which allows users to share stuff on a web-page by clicking on an 'email to friend' link; similar to what extole is doing here ...
0
votes
0answers
70 views

Web service security - authorization

I am trying to look for state-of-the-art approaches to do authorization to secure web services and SOA's in general. I found the following two articles while searching: link1 and link2. I find that ...
2
votes
2answers
170 views

Is a REST webservice without any authentication or authorization unsecure?

There is a REST-based webservice that has no authentication or authorization whatsoever - anyone that knows an URL of a particular method of this webservice can use it. However, the URLs of methods ...
0
votes
0answers
153 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...
4
votes
2answers
236 views

Is conveying patient MRN in a web service URL a HIPAA PHI violation?

I'm building a web service to access patient data within our EMR and would like to subscribe to RESTful design principles. However, the idea of including the patient MRN in a GET request makes me ...
1
vote
2answers
514 views

Secure android and server calls

I plan on adding an authentication system on my android app using web services. When my app calls the server using a POST call how can i secure the client can't find the URL and try to do his own ...
1
vote
1answer
387 views

decrypt a soap message using openssl

I've tried to do the same as found in How to you manually decrypt a SOAP message using openssl? Unfortunatly without success... Here is my situation : I'm trying to do the same stuff only my data ...
1
vote
2answers
76 views

What do we have to keep in mind when opening up our data to a third party?

We have a database with pictures (amongst other things). We have a few apps that can connect to this database via a php webservice (send https requests to a php file to retrieve stuff from the db and ...
2
votes
1answer
368 views

Sending data from Android client to database

I have created an Android app which sends data to a web service (wcf). Right now the user sends his test result (test id, test name, test time and user ID. The problem is that I send the data from the ...
-7
votes
2answers
360 views

I need to hack my website [closed]

I'm writing a simple web framework for a project of mine and need to ensure that the websites it produces are secure. In order to check this I thought I might as well just try and hack my own website ...
0
votes
1answer
50 views

Is there any security concern if I sent the security token, issued from a trusted IdP, to javaScript?

Is there any problem if I sent the identity token, which has been issued from a trusted IdP, to javaScript code in order to use it in an Ajax call to a web method with authentication? Is there any ...
3
votes
2answers
305 views

Preventing Illegal Access to Webservice

Let me start off by saying that I read other StackExchange questions related to this and they weren't really able to answer my question. I have a feeling this may be an unsolvable problem, but I'm ...
1
vote
1answer
105 views

Using salt or secret for Hmac

I'm working on a web API. We are going to use Hmac256 for signature hashing. From what I can gather, the secret is a key used to initialize the hash algorithm (ie to generate a random number). The ...
1
vote
1answer
107 views

What are the risks of protecting an API with one key only (without secret)?

I understand that a lot of APIs are protected using a (possibly public) API Key, to identify who is making the request, and a secret to hmac the parameters and determine if the client is actually who ...
0
votes
0answers
36 views

Authentication for Restful web services [duplicate]

I am building a restful web services. My requirement is that I have to provide authentication for accessing the webservices. First I tried with basic authentication. Which is working fine, but ...
4
votes
1answer
183 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
4
votes
2answers
286 views

Is there a strong reason to salt and hash passwords when password reuse is not an issue?

I am dealing with a system (in development) that uses randomly generated (not user provided), unique, strings to authenticate services that will consuming an API. Right now, these strings are stored ...
2
votes
3answers
470 views

Can an unlisted directory on webserver be discovered?

Assume the following sample directory: - / - /images - /28374728127636438 - /css Directory listing is disabled on the server and the directory named 28374728127636438 never linked anywhere on the ...
1
vote
2answers
106 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
1
vote
2answers
373 views

How to secure a web service for web applications using same database?

I have 2 or more web applications that need to be able to communicate together using a web service interface. Information All applications are using TLS/SSL (https) All applications have access to ...
0
votes
2answers
168 views

How the address bar manage the XSS?

I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : ...
1
vote
3answers
319 views

Is PGP suitable for encrypting webservices?

I would like to know if I can use of PGP to ensure SOAP webservices confidentiality? I don't want use SSL, it's kind of slow mechanism to make a tunnel for high throughput data transaction. I though ...