A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

1
vote
1answer
38 views

decrypt a soap message using openssl

I've tried to do the same as found in How to you manually decrypt a SOAP message using openssl? Unfortunatly without success... Here is my situation : I'm trying to do the same stuff only my data ...
1
vote
2answers
40 views

What do we have to keep in mind when opening up our data to a third party?

We have a database with pictures (amongst other things). We have a few apps that can connect to this database via a php webservice (send https requests to a php file to retrieve stuff from the db and ...
0
votes
0answers
18 views

sending data from android client to database

I have created an android app which sends data to a web service (wcf). Right now the user sends his test result (test id, test name, test time and user ID) the problem is I that i send the data from ...
-8
votes
2answers
91 views

I need to hack my website [closed]

I'm writing a simple web framework for a project of mine and need to ensure that the websites it produces are secure. In order to check this I thought I might as well just try and hack my own website ...
0
votes
1answer
36 views

Is there any security concern if I sent the security token, issued from a trusted IdP, to javaScript?

Is there any problem if I sent the identity token, which has been issued from a trusted IdP, to javaScript code in order to use it in an Ajax call to a web method with authentication? Is there any ...
3
votes
2answers
176 views

Preventing Illegal Access to Webservice

Let me start off by saying that I read other StackExchange questions related to this and they weren't really able to answer my question. I have a feeling this may be an unsolvable problem, but I'm ...
1
vote
1answer
36 views

Using salt or secret for Hmac

I'm working on a web API. We are going to use Hmac256 for signature hashing. From what I can gather, the secret is a key used to initialize the hash algorithm (ie to generate a random number). The ...
1
vote
1answer
74 views

What are the risks of protecting an API with one key only (without secret)?

I understand that a lot of APIs are protected using a (possibly public) API Key, to identify who is making the request, and a secret to hmac the parameters and determine if the client is actually who ...
0
votes
0answers
32 views

Authentication for Restful web services [duplicate]

I am building a restful web services. My requirement is that I have to provide authentication for accessing the webservices. First I tried with basic authentication. Which is working fine, but ...
4
votes
1answer
108 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
3
votes
2answers
183 views

Is there a strong reason to salt and hash passwords when password reuse is not an issue?

I am dealing with a system (in development) that uses randomly generated (not user provided), unique, strings to authenticate services that will consuming an API. Right now, these strings are stored ...
2
votes
3answers
381 views

Can an unlisted directory on webserver be discovered?

Assume the following sample directory: - / - /images - /28374728127636438 - /css Directory listing is disabled on the server and the directory named 28374728127636438 never linked anywhere on the ...
1
vote
2answers
71 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
1
vote
2answers
141 views

How to secure a web service for web applications using same database?

I have 2 or more web applications that need to be able to communicate together using a web service interface. Information All applications are using TLS/SSL (https) All applications have access to ...
0
votes
2answers
89 views

How the address bar manage the XSS?

I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : ...
1
vote
3answers
104 views

Is PGP suitable for encrypting webservices?

I would like to know if I can use of PGP to ensure SOAP webservices confidentiality? I don't want use SSL, it's kind of slow mechanism to make a tunnel for high throughput data transaction. I though ...
0
votes
1answer
44 views

Why do people trust PlayFramework2 dependency management?

If you worked in a big company that was very security conscious, would you build a product based on PlayFramework2 underneath? Since it does automatic dependency resolution at load time, aren't you ...
1
vote
2answers
73 views

Is there a secret-sharing public-key-encryption-based service? [closed]

I need to share some sensitive information with someone else who can only communicate via E-mail. I don't love the idea of sharing this information freely over email in plain text, so I was ...
1
vote
0answers
41 views

Properly secure an API [closed]

I'm working on an application that basically match (IRL) two kind of persons. On the client side, the frontend is a single page application with a flow that looks like this: Details -> Login -> ...
0
votes
2answers
133 views

Securing Public Web Services - What is the best practice? [closed]

There seems to be a number of ways to secure web services. OAuth, API Keys, Tokens, WIF, etc. Since security is not my area of expertise, I am asking what is the best ways to secure public web ...
1
vote
1answer
121 views

Securing REST API that will accessed from different clients

I have developed a REST/JSON API. The API exposes a lot of features. The API will be consumed by applications we design internally (mobile apps and web apps), by applications designed by our resellers ...
0
votes
2answers
77 views

Best practice for two WebServices that have to authenticate with each other [closed]

I have two WebServices that are hosted by two different applications. Both Applications access each other's webservices: Now both WebServices have to authenticate with each other. Different ...
2
votes
2answers
180 views

Is this token based web service secure?

Note: Original question asked at http://stackoverflow.com/questions/24012390/is-this-token-based-web-service-secure but here seems to be the right place for it. The company that I current work for ...
0
votes
1answer
275 views

Force download files protected with auth headers

By several REST clients the credentials are sent with every request through custom HTTP authorization headers to the REST service. Is there a way to force file download in the browser when accessing ...
0
votes
1answer
31 views

Safely converting untrusted files with Microsoft Word in a web service

I'm made a small web service that gets urls, download them, and convert them for another format. Most of those urls are documents (doc, docs,...). Basically, I'm open them with MS-Word and convert ...
6
votes
4answers
430 views

Is it secure to use *no authentication* for services listening only on localhost?

I have many applications installed on my server that use a webui frontend to control the application. Since I am the only user of the server, I usually bind these applications to 127.0.0.1. As the ...
-2
votes
1answer
497 views

Can a sysadmin spy on a Wifi connection? [duplicate]

Is it possible that someone who is in charge of a network serving many users, can see what site we visited? I mean, we have only one internet connection, and we used WiFi to be connected. Is it ...
1
vote
0answers
233 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
1
vote
1answer
78 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
2
votes
2answers
233 views

Security in large-scale SOAs

Let's assume a service-oriented architecture (SOA) with hundreds of services. The services are completely isolated – what is behind their APIs is an implementation detail. Different services can have ...
3
votes
1answer
1k views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
1
vote
1answer
120 views

Is it illegal to publicly reveal security flaws in a service? [closed]

Mainly I'm interested in UK law on this, but I welcome input from any jurisdiction. I discovered flaws in a service that undermined the security of all its user's data. This is a service where users ...
1
vote
1answer
297 views

What popular online services allow passwordless authentication using digital signatures? [closed]

I am looking for web services that allow clients to authenticate using digital signatures. Especially with e-commerce and payments, clients generally authenticate using name and password (sometimes ...
1
vote
2answers
498 views

REST security standards

As far as I know, SOAP services have security standards recognized by OASIS and W3C, such as: XML-Encryption XML-Signature SAML Are there any security standards for RESTful services?
12
votes
2answers
564 views

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
3
votes
2answers
220 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
1
vote
1answer
145 views

Is this where a nonce comes into play?

I'm reviewing a website a friend developed, and was looking for general errors and concerns. In reviewing I noticed he is very heavy on ajax calls using JSON to a RESTful API that he maintains on a ...
0
votes
1answer
72 views

Is it reasonable to use a security proxy when integrating two web applications?

Background: We're in the process of integrating two web applications. The other one, application A, is a publicly accessible Internet service, which is provided by a third party and which offers Web ...
2
votes
1answer
2k views

Authenticating Users from Android with PHP Webservice

I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice. But I'm a little confused over the authentication scheme. I ...
1
vote
2answers
2k views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
-1
votes
2answers
138 views

Are there any mail services that don't store encryption keys?

According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ Gmail doesn't store the encryption key. But Gmail reads whole of users' email for ...
1
vote
1answer
75 views

Blocking Internet Monitoring Software

So if a provider has software that blocks you from using their internet to connect to, say, Spotify or Skype. Is there a way to block your computer from communicating that this program is running? Or ...
1
vote
0answers
86 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
4
votes
1answer
343 views

HMAC needed with SSL/AccessToken in place?

Is using an HMAC in web service messages overkill if you are already using SSL and Access Tokens? I’m thinking of further ways to secure a service, and HMAC message signing is one. But it comes with ...
2
votes
2answers
148 views

How to securely provide data to a web server using a data warehouse?

We have a data warehouse that stores prices for our products. Once every business day, new data points are added representing the day's price for each product. On the website, a user sees this ...
-1
votes
2answers
117 views

Executing PHP WeService script by clicking a link within an e-mail

I'm receiving e-mail from my PHP/MySQL application with certain links. I was thinking on including an UUID as part of the link, which would point to a Web Service that ONLY reads those UUIDs. Those ...
4
votes
1answer
128 views

Storing product keys on same server as shop?

Situation: An e-commerce system (specifically: PrestaShop) which is used to sell virtual products (specifically: product license keys). To accelerate order processing, a cronjob is supposed to be ...
5
votes
1answer
1k views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile website to make my service also available for other mobile operating systems. Now, ...
0
votes
1answer
111 views

Service TO Service Authentication & authorization [duplicate]

I have two web services A and B the requests between those services is http. I want so establish a secure connection between service A and service B to ensure the authorized and authenticate request ...
1
vote
1answer
182 views

How do you limit javascript api to a domain?

Ok, many of you now the scenario: you login to developer.sayLinkedIn.com, create an app with credentials and define the domain in witch that key is allowed to "run". The question is, from a api ...