A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

4
votes
3answers
592 views

Is conveying patient MRN in a web service URL a HIPAA PHI violation?

I'm building a web service to access patient data within our EMR and would like to subscribe to RESTful design principles. However, the idea of including the patient MRN in a GET request makes me ...
16
votes
3answers
2k views

Is exposing exception information in web service a security risk? [duplicate]

It is a known fact that exposing the exception information to the end user provides security risks since an adversary can user that to figure out how things work internally and attack it. But what ...
1
vote
0answers
24 views

Are Web Services vulnerable to CSRF?

I'm testing an android application, it uses web services for every action, so I saw the requests don't have tokens or another anti-automation mechanism, they just need to validate a token to identify ...
3
votes
3answers
92 views

SSL Certificate in my hosting makes me change my java code?

Sorry for my stupid question. But I really want to know what is gonna happen.. I have a webservice hosted over the http protocol. I wanna buy an SSL certificate to have my webservice hosting with ...
2
votes
2answers
302 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
1
vote
1answer
40 views

Is it possible to give legal value to signed web services?

The context is using digitally signed webservices (with XML-DSIG for example) for e-government interoperability between databases. The idea is to give endorsement to both the data publisher and the ...
3
votes
4answers
118 views

Is a users mobile number available to a web service?

The reason I am asking this question is that I just noticed 6 lots of £1.25 charges on my mobile phone bill. I called up the phone company and they said that they are charges from a company called ...
5
votes
1answer
81 views

Simple, Secure PHP API Design

I'm trying to design a secure RESTful API web service with as few moving parts as possible. I have some questions, and want to make sure my design is secure. For the data transmission level of ...
4
votes
5answers
2k views

Why would someone want to encrypt RSS feeds?

I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
3
votes
3answers
86 views

What are the security risks of importing and processing an excel spreadsheet from an untrusted user

I'm working on a web application and we have an administrative feature that allows admins to import an excel spreadsheet containing information about sub-users they would like to add. We parse the ...
3
votes
0answers
54 views

How safe is WebCryptoAPI these days?

The 1Password Tool (software) introduced the 1Password for Teams. Now I thought this is a great peace of Software. But now they can show Passwords in the Browser. They do say: We encrypt ...
2
votes
2answers
354 views

Are these merchant integration instructions wrong about server-client interaction?

I'm working with a payment gateway that seems to have a fundamental misunderstanding of "clients" and how to protect sensitive data. The integration instructions are mostly about a "redirect" mode of ...
8
votes
2answers
3k views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile web-site to make my service also available for other mobile operating systems. ...
3
votes
1answer
64 views

Can timing attacks over a webservice be eliminated by standardizing the time it takes to return a request?

For example, would this (pseudo)-code work? let t = timeRightNow() let message = stuffWhoseTimingCantBeLeaked() waitUntilTime(t+1 second) send message Or similar? That way the time that the message ...
2
votes
1answer
75 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
3
votes
2answers
49 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
2
votes
2answers
54 views

Javascript videoplayer attack vectors [closed]

My team is building a Javascript-based video player for our own platform, instead of relying on other already available options like video.js. I'm wondering which attack vectors should I take into ...
-1
votes
1answer
36 views

SSL cert and region performance [closed]

I was asked to find the best available SSL cert for deploying a global solution in which performance is critical. But... does it really matter who is going to be the CA? AFAIK (never set up SSL ...
0
votes
0answers
18 views

Denial of service async Web service

Is it possible to perform a denial of service attack on an async service? Isnt the operating system supposed to release the thread? Im thinking it doesn't't matter as someone attacking a system would ...
2
votes
4answers
116 views

Public access to IIS Web server inside company network, for one specific service

I'm developing a mobile app which needs to access a specific server inside a company network, and should be able to do so from anywhere in the world. The app communicates via HTTP to a Web service on ...
1
vote
1answer
131 views

Saving encrypted username password in session

I have Node.js server which serves an app. In that app you could be asked to login. The login credentials would be authenticated against LDAP. That server could request/post data from other servers ...
0
votes
2answers
50 views

Are third party authentification provider included via iframe by default considered (in)secure?

Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form ...
20
votes
3answers
279 views

What precautions should I take when creating users that will be used by applications and not by people?

I have some applications that need to access to a webservices bus. Own applications that access to the bus authenticate using a webservice on that bus but in this case I need that third party ...
1
vote
0answers
26 views

central auth servers and in-app password changing

BLUF: philosophically, when (if?) should (web) services that use a central auth server add the power to change passwords? Simplified definitions, for the sake of this question: Central Auth Server: ...
5
votes
3answers
1k views

SSL inspection detection

An interesting question was recently asked about SSL inspection, and that got me wondering if it is actually possible, from the end user (or even server side), to detect if the SSL link is being ...
3
votes
2answers
728 views

Sending data from Android client to database

I have created an Android app which sends data to a web service. Right now the user sends his test results (test id, test name, test time, and user ID). The problem is that I send the data from the ...
0
votes
1answer
53 views

Basis for “trusting” third party code and services

I remember reading an article mentioning, that third party services and code should not be trusted, meaning blind trust. So, i was thinking, everyone uses third party code in software development ...
3
votes
2answers
1k views

List of web session attacks and counter measures

I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a ...
0
votes
1answer
18 views

How long should a shared link (token in the URL) be?

Suppose we have a web service operation like: GetComments(encryptedDiscussionID) // returns list of comments Where encryptedDiscussionID is the encrypted version of the actual discussionID in the ...
12
votes
5answers
8k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
7
votes
2answers
5k views

How can I prevent reflected XSS in my JSON web services?

I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response. This is open to XSS if the response is rendered as HTML by the browser since someone ...
3
votes
1answer
107 views

Public Key Certificate Pinning and MITM attack

So I was looking at an example of how to implement public key pinning for when your app connects to your web service and you want to have your app ensure it's really talking to your server. ...
3
votes
4answers
81 views

How to Protect Webservice on Private Network?

We are building a webservice that will only be queried by other servers on our private network. I was suggesting that we put that webservice over https and use either client ssl authentication or a ...
4
votes
2answers
236 views

Unseen.is encryption claims revisited with their proprietary, patented “xAES” algorithm

I had asked last year about the encryption claims by the web service called https://unseen.is. The very same service that had claims of "beyond army level encryption", "4096 bit keys" etc. This is the ...
1
vote
0answers
41 views

Verify request using the X509 certificate [closed]

I have a SOAP server. The soap request that is receiving at the server has ws security headers. Following are the main nodes of the request XML. BinarySecurityToken (X509PKIPathv1 certificate) ...
4
votes
2answers
39k views

What is s3.amazonaws.com, and why is Chrome blocking it?

Lately, whenever I click on a download link in Google Chrome, it redirects to another link starting with s3.amazonaws.com, which in turn gets blocked either by Chrome or by my Antivirus (Comodo ...
3
votes
3answers
462 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
2
votes
1answer
2k views

How does a developer interact with Microsoft Certificate *Web Services*

Microsoft Certificate Web Services is a HTTPS web service (WS-Trust) that has no Kerberos dependency and can be used on a variety of devices. This is new in Windows 2008 and is separate from the ...
5
votes
3answers
4k views

web services: how prevent illegal accesses

As suggested by someone I post a question here (for the first time). I'm using web services from an Android application. I use https (I bought a SSL certificate). I want to prevent unwanted accesses ...
4
votes
3answers
206 views

Can OAuth2 help to authenticate the app?

We have a mobile app that communicates with our server via a RESTful HTTPS API. We also have an attacker pretending to be our app while attempting to communicate with our web services API. We assume ...
0
votes
0answers
139 views

Using WCFs WS-security implementation, how can the server verify client identity?

Using the configuration below we have implemented message security using WCF and WS-security. Note that we use clientCredentialType=Certificate. Now my questions are: Does the configuration below ...
8
votes
4answers
10k views

Are there faux/fake malicious websites to test web reputation services similar to EICAR?

Antivirus writers have agreed for their software to recognize a standard "fake" virus file - the EICAR file, to let users check, that the software is up and running. Are there any equivalent test ...
9
votes
3answers
979 views

What to do when you can’t protect mobile app secret keys?

We have a mobile app for iOS and Android available in the Apple and Google Play stores. The app communicates with our server’s Web Services over HTTPS. We have attackers able to spoof the app ...
0
votes
1answer
67 views

Key management: Detecting that a key has been compromised?

I am looking at communication between our iOS/Android mobile app on the one side, and our RESTful web services API on the other side. From the server side, I have to assume that anything I receive is ...
0
votes
1answer
184 views

Does certificate pinning protect against Fiddler?

We have a mobile app that connects to our server via RESTful HTTPS web services. We also have an attacker who correctly emulates our app in communicating with our server. We therefore assume that our ...
2
votes
1answer
151 views

Access documents on internal network with website securely

I have a large document store of client data on my internal network. I am in the process of engaging some developers to build a website to make this data available to my clients externally. I also ...
2
votes
2answers
50 views

Can a web-filter track my internet access over application API calls?

I'm at college where each student has a login ID and password for internet access through the CyberRoam web filter for blocking certain websites. My question is, when I'm browsing Facebook, YouTube, ...
-2
votes
4answers
197 views

Google News, unencrypted by default- MITM vulnerability?

http://news.google.com Of course, if you are already logged into a Google account for that browser session, it is served encrypted. So when a user visits unencrypted Google News page, and taking ...
1
vote
3answers
234 views

How to Stop DDoS Attacks by simple function on web server?

I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong. Option 1 From the basic understanding of the DDOS attacks is that the attacker ...
0
votes
1answer
153 views

Bell-LaPadula model and composite services

The Bell-LaPadula model is useful for access control. Can I use this model for access control in composite services? The security level of each service is exported from WS_SecurityPolicy file.