A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

0
votes
0answers
35 views

Calling a HTTPS web service [on hold]

Background I have a Java application, one part of it is to call a HTTPS web service regarding payment (offered by a company called PayPoint). The application is sitting on a IBM Websphere server. ...
0
votes
2answers
38 views

SQL Injection in a Web Service URL as a Parameter Value

Obviously SQL Injection via the payload of a message is a very common practice and therefore it is always key to cover this (I already have in my code). However I'm just wondering about how possible ...
0
votes
1answer
15 views

How secure is my rstudio setup? [closed]

I am creating an Amazon EC2 instance to host an rstudio service. This service will be available through a reverse proxy through Apache server on port 443. I am a statistician and I am pretty ...
0
votes
0answers
48 views

Firefox stopped working with our app after 36.0.1 [migrated]

We have a web application that works on all browsers and firefox before 36.0.1 Have done all the typical things, clearing cache, reinstalling ff, etc. Multiple different machine from different ...
0
votes
0answers
26 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
0
votes
1answer
58 views

Security tradeoffs while designing a mobile Web Service API

I'm not a security expert but I want to ask about tradeoffs in a web service API I'm designing for mobile apps. It is an API which tracks users' locations so yes, the data is reasonably sensitive. ...
1
vote
0answers
54 views

Is generating custom authentication token for WCF service requests a good practice?

I have public WCF web service which works over https. There are lots of technical restrictions on client side, so I can't use any advanced schemes like oauth. I have registered users and some of them ...
1
vote
1answer
48 views

Simple way to secure a webservice used by mobile clients

I am currently working on a RESTful webservice with Java that is used by mobile devices, namely Android and iOS, using a framework that allows me to abstract from both. I'm adding this information ...
1
vote
0answers
29 views

Correct approach to secure the back end service - oAuth

I'm developing a oAuth service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants. basically users can purchase goods from Merchant's E-Commerce ...
0
votes
2answers
52 views

HTTPS in request and HTTP in response [closed]

If I have an API that calls a backend webservice, is it possible to use HTTPS in the request and just HTTP in the response? I have such a question because I want to protect my OAuth token in my ...
1
vote
0answers
123 views

Secure Requests Between iOS App and PHP Server

I'm developing an iOS app that requires data to be sent to a server to process a transaction. The data is stored on Stripe (A credit card service) so I do not need to worry about encrypting / storing ...
0
votes
2answers
62 views

How to block spammers from using my public email api

I am working on a web application which allows users to share stuff on a web-page by clicking on an 'email to friend' link; similar to what extole is doing here ...
0
votes
0answers
60 views

Web service security - authorization

I am trying to look for state-of-the-art approaches to do authorization to secure web services and SOA's in general. I found the following two articles while searching: link1 and link2. I find that ...
1
vote
2answers
67 views

Is a REST webservice without any authentication or authorization unsecure?

There is a REST-based webservice that has no authentication or authorization whatsoever - anyone that knows an URL of a particular method of this webservice can use it. However, the URLs of methods ...
0
votes
1answer
95 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...
3
votes
2answers
56 views

Is conveying patient MRN in a web service URL a HIPAA PHI violation?

I'm building a web service to access patient data within our EMR and would like to subscribe to RESTful design principles. However, the idea of including the patient MRN in a GET request makes me ...
0
votes
2answers
152 views

Secure android and server calls

I plan on adding an authentication system on my android app using web services. When my app calls the server using a POST call how can i secure the client can't find the URL and try to do his own ...
1
vote
1answer
168 views

decrypt a soap message using openssl

I've tried to do the same as found in How to you manually decrypt a SOAP message using openssl? Unfortunatly without success... Here is my situation : I'm trying to do the same stuff only my data ...
1
vote
2answers
50 views

What do we have to keep in mind when opening up our data to a third party?

We have a database with pictures (amongst other things). We have a few apps that can connect to this database via a php webservice (send https requests to a php file to retrieve stuff from the db and ...
0
votes
0answers
149 views

sending data from android client to database

I have created an android app which sends data to a web service (wcf). Right now the user sends his test result (test id, test name, test time and user ID) the problem is I that i send the data from ...
-8
votes
2answers
272 views

I need to hack my website [closed]

I'm writing a simple web framework for a project of mine and need to ensure that the websites it produces are secure. In order to check this I thought I might as well just try and hack my own website ...
0
votes
1answer
37 views

Is there any security concern if I sent the security token, issued from a trusted IdP, to javaScript?

Is there any problem if I sent the identity token, which has been issued from a trusted IdP, to javaScript code in order to use it in an Ajax call to a web method with authentication? Is there any ...
3
votes
2answers
228 views

Preventing Illegal Access to Webservice

Let me start off by saying that I read other StackExchange questions related to this and they weren't really able to answer my question. I have a feeling this may be an unsolvable problem, but I'm ...
1
vote
1answer
55 views

Using salt or secret for Hmac

I'm working on a web API. We are going to use Hmac256 for signature hashing. From what I can gather, the secret is a key used to initialize the hash algorithm (ie to generate a random number). The ...
1
vote
1answer
80 views

What are the risks of protecting an API with one key only (without secret)?

I understand that a lot of APIs are protected using a (possibly public) API Key, to identify who is making the request, and a secret to hmac the parameters and determine if the client is actually who ...
0
votes
0answers
33 views

Authentication for Restful web services [duplicate]

I am building a restful web services. My requirement is that I have to provide authentication for accessing the webservices. First I tried with basic authentication. Which is working fine, but ...
4
votes
1answer
145 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
4
votes
2answers
230 views

Is there a strong reason to salt and hash passwords when password reuse is not an issue?

I am dealing with a system (in development) that uses randomly generated (not user provided), unique, strings to authenticate services that will consuming an API. Right now, these strings are stored ...
2
votes
3answers
405 views

Can an unlisted directory on webserver be discovered?

Assume the following sample directory: - / - /images - /28374728127636438 - /css Directory listing is disabled on the server and the directory named 28374728127636438 never linked anywhere on the ...
1
vote
2answers
82 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
1
vote
2answers
245 views

How to secure a web service for web applications using same database?

I have 2 or more web applications that need to be able to communicate together using a web service interface. Information All applications are using TLS/SSL (https) All applications have access to ...
0
votes
2answers
105 views

How the address bar manage the XSS?

I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : ...
1
vote
3answers
172 views

Is PGP suitable for encrypting webservices?

I would like to know if I can use of PGP to ensure SOAP webservices confidentiality? I don't want use SSL, it's kind of slow mechanism to make a tunnel for high throughput data transaction. I though ...
0
votes
1answer
48 views

Why do people trust PlayFramework2 dependency management?

If you worked in a big company that was very security conscious, would you build a product based on PlayFramework2 underneath? Since it does automatic dependency resolution at load time, aren't you ...
1
vote
2answers
82 views

Is there a secret-sharing public-key-encryption-based service? [closed]

I need to share some sensitive information with someone else who can only communicate via E-mail. I don't love the idea of sharing this information freely over email in plain text, so I was ...
1
vote
0answers
47 views

Properly secure an API [closed]

I'm working on an application that basically match (IRL) two kind of persons. On the client side, the frontend is a single page application with a flow that looks like this: Details -> Login -> ...
0
votes
2answers
194 views

Securing Public Web Services - What is the best practice? [closed]

There seems to be a number of ways to secure web services. OAuth, API Keys, Tokens, WIF, etc. Since security is not my area of expertise, I am asking what is the best ways to secure public web ...
2
votes
1answer
153 views

Securing REST API that will accessed from different clients

I have developed a REST/JSON API. The API exposes a lot of features. The API will be consumed by applications we design internally (mobile apps and web apps), by applications designed by our resellers ...
0
votes
2answers
82 views

Best practice for two WebServices that have to authenticate with each other [closed]

I have two WebServices that are hosted by two different applications. Both Applications access each other's webservices: Now both WebServices have to authenticate with each other. Different ...
2
votes
2answers
212 views

Is this token based web service secure?

Note: Original question asked at http://stackoverflow.com/questions/24012390/is-this-token-based-web-service-secure but here seems to be the right place for it. The company that I current work for ...
0
votes
1answer
372 views

Force download files protected with auth headers

By several REST clients the credentials are sent with every request through custom HTTP authorization headers to the REST service. Is there a way to force file download in the browser when accessing ...
0
votes
1answer
32 views

Safely converting untrusted files with Microsoft Word in a web service

I'm made a small web service that gets urls, download them, and convert them for another format. Most of those urls are documents (doc, docs,...). Basically, I'm open them with MS-Word and convert ...
7
votes
4answers
444 views

Is it secure to use *no authentication* for services listening only on localhost?

I have many applications installed on my server that use a webui frontend to control the application. Since I am the only user of the server, I usually bind these applications to 127.0.0.1. As the ...
-2
votes
1answer
726 views

Can a sysadmin spy on a Wifi connection? [duplicate]

Is it possible that someone who is in charge of a network serving many users, can see what site we visited? I mean, we have only one internet connection, and we used WiFi to be connected. Is it ...
1
vote
0answers
255 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
1
vote
1answer
92 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
3
votes
2answers
245 views

Security in large-scale SOAs

Let's assume a service-oriented architecture (SOA) with hundreds of services. The services are completely isolated – what is behind their APIs is an implementation detail. Different services can have ...
3
votes
1answer
1k views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
1
vote
1answer
124 views

Is it illegal to publicly reveal security flaws in a service? [closed]

Mainly I'm interested in UK law on this, but I welcome input from any jurisdiction. I discovered flaws in a service that undermined the security of all its user's data. This is a service where users ...
1
vote
1answer
328 views

What popular online services allow passwordless authentication using digital signatures? [closed]

I am looking for web services that allow clients to authenticate using digital signatures. Especially with e-commerce and payments, clients generally authenticate using name and password (sometimes ...