A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

8
votes
2answers
528 views

Safe YAML parser?

I've recently read that YAML was not "designed to handle malicious user input", because a malicious YAML input "can create instances of all classes defined in the targeted Rails application". ...
4
votes
4answers
2k views

Why would someone want to encrypt RSS feeds?

I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
1
vote
2answers
1k views

How do I holistically protect a web service from network and MITM attacks?

I have several financial web services that are accessed over HTTPS, however the client devices may be accessing the web services over untrusted WiFi, through questionable proxies, and possibly ToR ...
5
votes
4answers
8k views

What does scorecardsresearch.com/beacon.js - added by Disqus.com - do?

I recently added Disqus to my site. Looking at the "scripts" tab on Firebug, I noticed a script called, http://scorecardresearch.com/beacon.js (here is a prettified version - the script is not ...
2
votes
2answers
801 views

Is there any way to differentiate between a normal web request and a web service request?

I have a security layer for providing the security of the requests that come to my server. For all web request that come in a login page is shown if cookie is not present. I am now introducing web ...
1
vote
1answer
212 views

How safe is WSIT username authentication with symmetric key?

I have an ajax-ws web service (exposed via glassfish) that uses username authentication with a symmetric key to encrypt and authenticate clients(link). How secure is this mechanism? Is this enough to ...
3
votes
3answers
223 views

Monitoring for security threats

I host and maintain several websites. The users pay to have their sites maintained and secured. However, with the amount of web applications like joolma, wordpress, ect... and their plugins, I need a ...
3
votes
1answer
322 views

Payment security on Android App

I am developing an application from which users browse and buy books. The client can be Android ,iOS, Mac. The server is ASP.net Web APIs. I know there are many payment services available. One of ...
6
votes
2answers
541 views

Does anyone use XML Encryption?

The XML standard defines a mechanism for encrypting the data in a XML document. It's part of the standard. Does anyone use this XML encryption format? Are there any significant deployed systems ...
0
votes
1answer
632 views

Is it dangerous to serve executable cgi files in public folder?

In the past, Apache used to serve cgi files from cgi-bin folder only, and it was always advised to avoid putting executable files in public folders. However, today's webservers fairly serve executable ...
6
votes
2answers
5k views

How can I prevent reflected XSS in my JSON web services?

I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response. This is open to XSS if the response is rendered as HTML by the browser since someone ...
4
votes
2answers
970 views

Webservices exploitation / axis/services/AdminService?Method=AdminService

I'm writing to get some stuff on hardening some web-services, but I'm looking also for some tool to test web-services. I have a sandbox (can't post live URLs...) I'm trying some stuff to try to ...
20
votes
1answer
21k views

How to implement an API-Key-Mechanism

first of all: I am quite unsure about the questions title, so if you have a better idea, please feel free to tell (: I would like to know about best-practise examples where services (like Twitter or ...
11
votes
5answers
7k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
3
votes
5answers
3k views

How to secure a server backend

I am developing a server which serves two purposes: it is a CMS for people to use and maintain some data, and a Web Service for a mobile app to get this data. It runs on a Debian server running Tomcat ...
4
votes
3answers
1k views

What are the risks of posting my email address to pwnedlist.com?

pwnedlist.com claims to have details of over 23 million accounts that have been hacked, and if you submit your email address they'll apparently tell you if you're in the database. Are the people ...
5
votes
1answer
5k views

Facebook page receiving improbable amount of likes from unknown users

A bit of an odd problem, but I'm not totally sure where to post this. I am an administrator for a facebook page that suddenly began receiving hundreds of likes in the past few days. This trend began ...
1
vote
1answer
995 views

How secure is github's whitelisting CORS domains?

The Github API allows you to make requests using CORS [1]. The CORS requests are only allowed by certain whitelisted domains : Any domain that is registered as an OAuth Application is accepted. ...
5
votes
1answer
847 views

What are the security risks when using free Content delivery networks (CDNs)?

I was doing some research on Content Delivery Networks. For those who don't know, a CDN is a large collection of servers that cache and quickly serve up static content such as images, css, js, etc, to ...
2
votes
1answer
323 views

Are these merchant integration instructions wrong about server-client interaction?

I'm working with a payment gateway that seems to have a fundamental misunderstanding of "clients" and how to protect sensitive data. The integration instructions are mostly about a "redirect" mode of ...
14
votes
6answers
18k views

Securing an API for mobile access

I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
5
votes
3answers
1k views

SSL inspection detection

An interesting question was recently asked about SSL inspection, and that got me wondering if it is actually possible, from the end user (or even server side), to detect if the SSL link is being ...
5
votes
3answers
807 views

Is it a security risk to embed a commenting service (like Disqus) into our site?

Can commenting services like Disqus, IntenseDebate, etc. pose a security risk for corporations? Edit: What risks could arise when embedding such services into corporate websites?
4
votes
2answers
524 views

Is there a spreadsheet/template for Mapping WebServices Authorization Rules?

I'm looking for a spreadsheet/template that allows the business-rules (i.e. 'who has access to what') to be mapped, visualized and analyzed. In the past I have created a couple of these (some even ...
1
vote
1answer
563 views

Web Service Security

We are currently designing a Web Service that returns a JSON formatted messages. The following are the planned implementation for the service's security: An SSL Certification to the service for the ...
1
vote
1answer
508 views

How can a SAML Relying Party redirect to one of two IDPs?

We need to support the following Authentication flows User 1 logs into Salesforce using Salesforce Credentials User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials User 2 logs into ...
6
votes
4answers
4k views

HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?

We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
1
vote
1answer
267 views

Securing communication

The problem: I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
2
votes
2answers
835 views

How do I find .asmx files?

I have a web service (ASP.NET) running on my application server. It can be reached via http://xxxxxx/Servercomponents/servercomp.asmx Is possible to find this even if you don't know the file name ...
4
votes
1answer
1k views

How to implement WSS UsernameToken when password on the server is salted and hashed?

I'm currently trying to write a web service for customer and requirement is to use WS Security. On their server side, they have passwords stored as SHA-1(salt+password). According to WSS spec, ...
3
votes
2answers
1k views

Securely expose WebService from Enterprise Network to Internet Client

(coming from stackoverflow) Are there any standards (or certified solutions) to expose a (Web-)Service to the internet from a very security-sensitive network (e.g. Banking/Finance)? I am not ...
2
votes
2answers
2k views

Microsoft ASMX Web Services Test form available on remote machines

I have been doing some research about Web Services security. I noticed that some sites are using Ajax and JQuery to consume ASMX WebServices. I navigated to the Web Service EndPoint and I realized ...
2
votes
2answers
166 views

Would a large prime service be useful?

The target users would be portable/embedded devices or resource limited code (i.e. javascript). The idea being that the devices could poll the service for validated primes and use them for encryption ...
2
votes
3answers
262 views

Identifying and preventing execution of “any” function via Late-Bound commands

The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
1
vote
1answer
238 views

Does an exposed XMLRPC API in a web application pose a threat?

I'm given the assignment of testing one of our web-servers in regards to security. One of the servers run IIS 7 and its application relies extensively on XMLRPC calls. I found the API for those calls ...
4
votes
1answer
181 views

Services Like McAfee Secure

What do monitoring services like Mcafee Secure actually provide? It's about $1000 per year and I'm trying to judge what they actually do, as their benefits and technology pages might as well be the ...
9
votes
3answers
2k views

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
-3
votes
2answers
750 views

Web service that converts HTTP GET to POST? [closed]

Is there some online forwarding service that I can give HTTP GET parameters to, and it would create a form with the parameters and submit it as POST? For example, I'd like to give someone the URL: ...
1
vote
1answer
138 views

WebServices Security [closed]

Do we have any good resources on WebServices Security? Any book, pdfs, articles and even the detail answers regarding the securing web services would be appreciated.
4
votes
3answers
1k views

Paypal IPN, SSL and man-in-the-middle attacks

Okay, suppose I have been implementing paypal IPN, and my server will respond by verifying with "https://www.paypal.com/cgi-bin/webscr" and got the VERIFIED message back. First, if my server connects ...
3
votes
2answers
1k views

List of web session attacks and counter measures

I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a ...
4
votes
4answers
830 views

Ensuring a web-service only processes requests from specific computers

I'm in the process of designing a system that consists a client application and a single web-service. The client is distributed on several machines (installed by me or a colleague), and the ...
7
votes
4answers
638 views

What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled

as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages: http://www.straightsectalk.com/?p=47 ...
16
votes
1answer
4k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...