A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

2
votes
1answer
303 views

Are these merchant integration instructions wrong about server-client interaction?

I'm working with a payment gateway that seems to have a fundamental misunderstanding of "clients" and how to protect sensitive data. The integration instructions are mostly about a "redirect" mode of ...
12
votes
6answers
15k views

Securing an API for mobile access

I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
5
votes
3answers
771 views

Is it a security risk to embed a commenting service (like Disqus) into our site?

Can commenting services like Disqus, IntenseDebate, etc. pose a security risk for corporations? Edit: What risks could arise when embedding such services into corporate websites?
3
votes
2answers
471 views

Is there a spreadsheet/template for Mapping WebServices Authorization Rules?

I'm looking for a spreadsheet/template that allows the business-rules (i.e. 'who has access to what') to be mapped, visualized and analyzed. In the past I have created a couple of these (some even ...
1
vote
1answer
520 views

Web Service Security

We are currently designing a Web Service that returns a JSON formatted messages. The following are the planned implementation for the service's security: An SSL Certification to the service for the ...
1
vote
1answer
430 views

How can a SAML Relying Party redirect to one of two IDPs?

We need to support the following Authentication flows User 1 logs into Salesforce using Salesforce Credentials User 2 logs into Salesforce using Arcot +Ping + Siteminder credentials User 2 logs into ...
6
votes
4answers
4k views

HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?

We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
1
vote
1answer
240 views

Securing communication

The problem: I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
2
votes
2answers
749 views

How do I find .asmx files?

I have a web service (ASP.NET) running on my application server. It can be reached via http://xxxxxx/Servercomponents/servercomp.asmx Is possible to find this even if you don't know the file name ...
3
votes
1answer
1k views

How to implement WSS UsernameToken when password on the server is salted and hashed?

I'm currently trying to write a web service for customer and requirement is to use WS Security. On their server side, they have passwords stored as SHA-1(salt+password). According to WSS spec, ...
3
votes
2answers
974 views

Securely expose WebService from Enterprise Network to Internet Client

(coming from stackoverflow) Are there any standards (or certified solutions) to expose a (Web-)Service to the internet from a very security-sensitive network (e.g. Banking/Finance)? I am not ...
2
votes
2answers
2k views

Microsoft ASMX Web Services Test form available on remote machines

I have been doing some research about Web Services security. I noticed that some sites are using Ajax and JQuery to consume ASMX WebServices. I navigated to the Web Service EndPoint and I realized ...
2
votes
2answers
136 views

Would a large prime service be useful?

The target users would be portable/embedded devices or resource limited code (i.e. javascript). The idea being that the devices could poll the service for validated primes and use them for encryption ...
2
votes
3answers
195 views

Identifying and preventing execution of “any” function via Late-Bound commands

The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
1
vote
1answer
200 views

Does an exposed XMLRPC API in a web application pose a threat?

I'm given the assignment of testing one of our web-servers in regards to security. One of the servers run IIS 7 and its application relies extensively on XMLRPC calls. I found the API for those calls ...
4
votes
1answer
176 views

Services Like McAfee Secure

What do monitoring services like Mcafee Secure actually provide? It's about $1000 per year and I'm trying to judge what they actually do, as their benefits and technology pages might as well be the ...
9
votes
3answers
2k views

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
-4
votes
2answers
698 views

Web service that converts HTTP GET to POST? [closed]

Is there some online forwarding service that I can give HTTP GET parameters to, and it would create a form with the parameters and submit it as POST? For example, I'd like to give someone the URL: ...
1
vote
1answer
137 views

WebServices Security [closed]

Do we have any good resources on WebServices Security? Any book, pdfs, articles and even the detail answers regarding the securing web services would be appreciated.
4
votes
3answers
1k views

Paypal IPN, SSL and man-in-the-middle attacks

Okay, suppose I have been implementing paypal IPN, and my server will respond by verifying with "https://www.paypal.com/cgi-bin/webscr" and got the VERIFIED message back. First, if my server connects ...
4
votes
4answers
767 views

Ensuring a web-service only processes requests from specific computers

I'm in the process of designing a system that consists a client application and a single web-service. The client is distributed on several machines (installed by me or a colleague), and the ...
6
votes
4answers
562 views

What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled

as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages: http://www.straightsectalk.com/?p=47 ...
15
votes
1answer
3k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...