A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...
0
votes
1answer
236 views
Web Service Security
We are currently designing a Web Service that returns a JSON formatted messages. The following are the planned implementation for the service's security:
An SSL Certification to the service for the ...
1
vote
1answer
152 views
How can a SAML Relying Party redirect to one of two IDPs?
We need to support the following Authentication flows
User 1 logs into Salesforce using Salesforce Credentials
User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials
User 2 logs into ...
5
votes
4answers
2k views
HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?
We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
0
votes
1answer
123 views
Securing communication
The problem:
I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
2
votes
2answers
351 views
How do I find .asmx files?
I have a web service (ASP.NET) running on my application server. It can be reached via
http://xxxxxx/Servercomponents/servercomp.asmx
Is possible to find this even if you don't know the file name ...
1
vote
1answer
446 views
How to implement WSS UsernameToken when password on the server is salted and hashed?
I'm currently trying to write a web service for customer and requirement is to use WS Security. On their server side, they have passwords stored as SHA-1(salt+password).
According to WSS spec, ...
3
votes
2answers
291 views
Securely expose WebService from Enterprise Network to Internet Client
(coming from stackoverflow)
Are there any standards (or certified solutions) to expose a (Web-)Service to the internet from a very security-sensitive network (e.g. Banking/Finance)?
I am not ...
1
vote
2answers
761 views
Microsoft ASMX Web Services Test form available on remote machines
I have been doing some research about Web Services security. I noticed that some sites are using Ajax and JQuery to consume ASMX WebServices. I navigated to the Web Service EndPoint and I realized ...
2
votes
2answers
128 views
Would a large prime service be useful?
The target users would be portable/embedded devices or resource limited code (i.e. javascript). The idea being that the devices could poll the service for validated primes and use them for encryption ...
3
votes
3answers
102 views
Identifying and preventing execution of “any” function via Late-Bound commands
The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
1
vote
1answer
114 views
Does an exposed XMLRPC API in a web application pose a threat?
I'm given the assignment of testing one of our web-servers in regards to security. One of the servers run IIS 7 and its application relies extensively on XMLRPC calls. I found the API for those calls ...
2
votes
1answer
107 views
Services Like McAfee Secure
What do monitoring services like Mcafee Secure actually provide? It's about $1000 per year and I'm trying to judge what they actually do, as their benefits and technology pages might as well be the ...
8
votes
3answers
1k views
Any flaws in this security model for a REST web service?
I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
-3
votes
2answers
394 views
Web service that converts HTTP GET to POST?
Is there some online forwarding service that I can give HTTP GET parameters to, and it would create a form with the parameters and submit it as POST?
For example, I'd like to give someone the URL:
...
1
vote
1answer
117 views
WebServices Security [closed]
Do we have any good resources on WebServices Security? Any book, pdfs, articles and even the detail answers regarding the securing web services would be appreciated.
3
votes
3answers
635 views
Paypal IPN, SSL and man-in-the-middle attacks
Okay, suppose I have been implementing paypal IPN, and my server will respond by verifying with "https://www.paypal.com/cgi-bin/webscr" and got the VERIFIED message back.
First, if my server connects ...
4
votes
4answers
435 views
Ensuring a web-service only processes requests from specific computers
I'm in the process of designing a system that consists a client application and a single web-service. The client is distributed on several machines (installed by me or a colleague), and the ...
5
votes
4answers
322 views
What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled
as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages:
http://www.straightsectalk.com/?p=47
...
12
votes
1answer
1k views
REST specific security weaknesses
I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST.
What I would ...
