A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

2
votes
4answers
83 views

Public access to IIS Web server inside company network, for one specific service

I'm developing a mobile app which needs to access a specific server inside a company network, and should be able to do so from anywhere in the world. The app communicates via HTTP to a Web service on ...
1
vote
1answer
114 views

Saving encrypted username password in session

I have Node.js server which serves an app. In that app you could be asked to login. The login credentials would be authenticated against LDAP. That server could request/post data from other servers ...
2
votes
2answers
172 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
0
votes
2answers
37 views

Are third party authentification provider included via iframe by default considered (in)secure?

Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form ...
20
votes
3answers
268 views

What precautions should I take when creating users that will be used by applications and not by people?

I have some applications that need to access to a webservices bus. Own applications that access to the bus authenticate using a webservice on that bus but in this case I need that third party ...
1
vote
0answers
24 views

central auth servers and in-app password changing

BLUF: philosophically, when (if?) should (web) services that use a central auth server add the power to change passwords? Simplified definitions, for the sake of this question: Central Auth Server: ...
5
votes
3answers
1k views

SSL inspection detection

An interesting question was recently asked about SSL inspection, and that got me wondering if it is actually possible, from the end user (or even server side), to detect if the SSL link is being ...
3
votes
2answers
630 views

Sending data from Android client to database

I have created an Android app which sends data to a web service. Right now the user sends his test results (test id, test name, test time, and user ID). The problem is that I send the data from the ...
0
votes
1answer
41 views

Basis for “trusting” third party code and services

I remember reading an article mentioning, that third party services and code should not be trusted, meaning blind trust. So, i was thinking, everyone uses third party code in software development ...
3
votes
2answers
1k views

List of web session attacks and counter measures

I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a ...
0
votes
1answer
16 views

How long should a shared link (token in the URL) be?

Suppose we have a web service operation like: GetComments(encryptedDiscussionID) // returns list of comments Where encryptedDiscussionID is the encrypted version of the actual discussionID in the ...
11
votes
5answers
7k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
6
votes
2answers
5k views

How can I prevent reflected XSS in my JSON web services?

I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response. This is open to XSS if the response is rendered as HTML by the browser since someone ...
4
votes
1answer
87 views

Public Key Certificate Pinning and MITM attack

So I was looking at an example of how to implement public key pinning for when your app connects to your web service and you want to have your app ensure it's really talking to your server. ...
3
votes
4answers
70 views

How to Protect Webservice on Private Network?

We are building a webservice that will only be queried by other servers on our private network. I was suggesting that we put that webservice over https and use either client ssl authentication or a ...
4
votes
2answers
210 views

Unseen.is encryption claims revisited with their proprietary, patented “xAES” algorithm

I had asked last year about the encryption claims by the web service called https://unseen.is. The very same service that had claims of "beyond army level encryption", "4096 bit keys" etc. This is the ...
1
vote
0answers
40 views

Verify request using the X509 certificate [closed]

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML. BinarySecurityToken (X509PKIPathv1 certificate) ...
4
votes
2answers
24k views

What is s3.amazonaws.com, and why is Chrome blocking it?

Lately, whenever I click on a download link in Google Chrome, it redirects to another link starting with s3.amazonaws.com, which in turn gets blocked either by Chrome or by my Antivirus (Comodo ...
3
votes
3answers
431 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
2
votes
1answer
2k views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
5
votes
3answers
4k views

web services: how prevent illegal accesses

As suggested by someone I post a question here (for the first time). I'm using web services from an Android application. I use https (I bought a SSL certificate). I want to prevent unwanted accesses ...
4
votes
3answers
174 views

Can OAuth2 help to authenticate the app?

We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API. We assume ...
0
votes
0answers
69 views

Using WCFs WS-security implementation, how can the server verify client identity?

Using the configuration below we have implemented message security using WCF and WS-security. Note that we use clientCredentialType=Certificate. Now my questions are: Does the configuration below ...
7
votes
4answers
8k views

Are there faux/fake malicious websites to test web reputation services similar to EICAR?

Antivirus writers have agreed for their software to recognize a standard "fake" virus file - the EICAR file, to let users check, that the software is up and running. Are there any equivalent test ...
8
votes
3answers
671 views

What to do when you can’t protect mobile app secret keys?

We have a mobile app for iOS and Android available in the Apple and Google Play stores. The app communicates with our server’s Web Services over HTTPS. We have attackers able to spoof the app ...
0
votes
1answer
57 views

Key management: Detecting that a key has been compromised?

I am looking at communication between our iOS/Android mobile app on the one side, and our RESTful web services API on the other side. From the server side, I have to assume that anything I receive is ...
0
votes
1answer
115 views

Does certificate pinning protect against Fiddler?

We have a mobile app that connects to our server via RESTful HTTPS web services. We also have an attacker who correctly emulates our app in communicating with our server. We therefore assume that our ...
2
votes
1answer
122 views

Access documents on internal network with website securely

I have a large document store of client data on my internal network. I am in the process of engaging some developers to build a website to make this data available to my clients externally. I also ...
2
votes
2answers
49 views

Can a web-filter track my internet access over application API calls?

I'm at college where each student has a login ID and password for internet access through the CyberRoam web filter for blocking certain websites. My question is, when I'm browsing Facebook, YouTube, ...
-1
votes
4answers
192 views

Google News, unencrypted by default- MITM vulnerability?

http://news.google.com Of course, if you are already logged into a Google account for that browser session, it is served encrypted. So when a user visits unencrypted Google News page, and taking ...
1
vote
3answers
187 views

How to Stop DDoS Attacks by simple function on web server?

I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong. Option 1 From the basic understanding of the DDOS attacks is that the attacker ...
0
votes
1answer
143 views

Bell-LaPadula model and composite services

The Bell-LaPadula model is useful for access control. Can I use this model for access control in composite services? The security level of each service is exported from WS_SecurityPolicy file.
2
votes
0answers
119 views

Correct approach to secure the back end service - oAuth

I'm developing a OAUTH service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants. basically users can purchase goods from Merchant's E-Commerce ...
4
votes
2answers
4k views

Checking SSL/TLS servers for NULL encryption support

I have a web server supporting SSL 3 and TLS protocols, the following are the supported cipher suites: TLS_RSA_WITH_RC4_128_MD5 TLS_RSA_WITH_RC4_128_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA How can I ...
1
vote
1answer
592 views

Is it possible to create secure streaming server

Right now I am thinking for a way to create a secure video streaming server with the following assumption: people can be trusted not to distribute the video they have rights to see. (I think in ...
0
votes
1answer
146 views

How secure are the passwords stored at Google Passwords? [closed]

It seems Google activated central place for storing app/website passwords which is accessible at https://passwords.google.com/ and all the remembered Chrome passwords are synched there. In what ...
-3
votes
3answers
81 views

What security problems are there with enabling directory listing on my webserver? [duplicate]

I want to to ensure that every file on my webserver is secured. The problems I am having right now: If you go to my website, and enter a url like mywebsite.com/img/ if there is no index page in ...
2
votes
0answers
45 views

Patterns for asynchronous authentication (after message is sent)

I'm looking at a scheme where users/servers post messages to each other. One of the main challenges is to prove "ownership" of a URL - defined as the ability to receive messages. This can be done ...
3
votes
2answers
333 views

Ways around browser xss detection

Most modern browsers will detect xss attempts (script code in the URL) and prevent execution. Are there any known standard ways around this or are xss attacks pretty much impossible now?
3
votes
4answers
98 views

How to avoid web service spam?

How can I restrict users from spamming my web service by sending thousands of requests? My web service is actually protected by a validation token only accessible through authentication, but I still ...
0
votes
0answers
107 views

Comparing Oauth and JWT auth in my web application

I have created an e-commerce website which has a REST API on the server side and Angular on the client side. I am considering to use OAuth to secure my API, but it seems to overkill because I have no ...
2
votes
2answers
163 views

Is writing to /dev/null secure?

I am working on a web-service based crypto project in JAVA. The basic idea is for the client to send a SOAP request to a servlet to encrypt data. For data transmission I am using MIME/data-handlers ...
-4
votes
2answers
70 views

How to ensure website from hackers and more? [closed]

I'm really new to security in Websites, for example... So can someone give me somewhere to start please? Sorry if it's not the right place to ask... :|
2
votes
0answers
51 views

Security implications of providing an encryption/decryption oracle

I need to provide a service that acts as a symetric encryption/decryption blackbox : the box get a secret key k users send datas d, and get ciphertext c = Encrypt(d,k) users send ciphertext c, and ...
0
votes
1answer
69 views

Control access to public API

I'm working on a public API for project X. System allows to register an app_id and call API methods providing it, as usual. Now, I need to develop an official mobile client for project X that should ...
1
vote
0answers
180 views

How to secure requests to my API from my web widget embedded in third party website

Background I'm designing a web widget for a new SaaS for embedding in a password-protected CMS. This would allow the customer to add something like the following to all the pages in their CMS to ...
4
votes
1answer
69 views

Where should a Vulnerability Disclosure Policy be published?

In 2014, the New Zealand Internet Task Force released a set of guidelines for Vulnerability Disclosure: http://www.nzitf.org.nz/pdf/NZITF_Disclosure_Guidelines_2014.pdf Part of the recommendations ...
4
votes
1answer
92 views

Purpose for “One Time Use Token”

I'm connecting a Salesforce ORG with a third party vender through a custom API (they basically wrote it just for us). The API requires you to retrieve a "token" that you pass into other calls through ...
0
votes
1answer
157 views

Choosing security scenario for WCF service/client hosted by IIS

I have web server (hosted using IIS) in DMZ hosts multiple web services (WCF), the clients are non-server applications (they are standalone .NET application) reaching these web services via internet ...
1
vote
1answer
2k views

How to exploit CRLF Injection?

I was running a few tests on a website when I came across this: Request: GET /accounts?intended_destination=internal_api%2Fcampaigns_dashboard%7Cshow&intended_params=format%3Dhtml HTTP/1.1 ...