A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

12
votes
2answers
411 views

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
3
votes
2answers
261 views

Should the Keygen element be used to create a certificate for mutual auth TLS? What alternatives are there?

I'm interested in using mutual auth TLS to improve the security of my javascript based webservices . I've looked at the Keygen element and given all its issues, not sure if this can even be used for ...
0
votes
1answer
156 views

Securing communication

The problem: I have an open-source client (a Firefox add-on written in JavaScript) and a server containing somewhat sensible user information: username and user history (all from YouTube). The client ...
13
votes
1answer
2k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
8
votes
3answers
1k views

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
5
votes
1answer
6k views

How to implement an API-Key-Mechanism

first of all: I am quite unsure about the questions title, so if you have a better idea, please feel free to tell (: I would like to know about best-practise examples where services (like Twitter or ...
6
votes
4answers
3k views

HMAC/PBKDF2 vs Simple hashing algorithm for web service authentication?

We are in the process of creating a web service and have been investigating ways of securing it. In reality, the service is likely to get very little traffic and the data is likely to be of little use ...
6
votes
4answers
2k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
6
votes
4answers
399 views

What abuses can an infected webpage do to me if I'm using Chrome and Flash is disabled

as a follow-up to this question Can you get virus just by visiting a website in chrome., I've read these pages: http://www.straightsectalk.com/?p=47 ...
3
votes
1answer
774 views

How to implement WSS UsernameToken when password on the server is salted and hashed?

I'm currently trying to write a web service for customer and requirement is to use WS Security. On their server side, they have passwords stored as SHA-1(salt+password). According to WSS spec, ...
1
vote
2answers
88 views

REST security standards

As far as I know, SOAP services have security standards recognized by OASIS and W3C, such as: XML-Encryption XML-Signature SAML Are there any security standards for RESTful services?