Tagged Questions

A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

1
vote
1answer
63 views

What are the risks of protecting an API with one key only (without secret)?

I understand that a lot of APIs are protected using a (possibly public) API Key, to identify who is making the request, and a secret to hmac the parameters and determine if the client is actually who ...
0
votes
0answers
55 views

Logging network traffic [migrated]

Don't know if this is right forum, so please excuse me for that. I have created a web service in ColdFusion and other application from outside the network is trying to access it via SOAP request ...
0
votes
0answers
32 views

Authentication for Restful web services [duplicate]

I am building a restful web services. My requirement is that I have to provide authentication for accessing the webservices. First I tried with basic authentication. Which is working fine, but ...
4
votes
1answer
89 views

How to store a group password for multi-user server-client web-application?

In a web application, accessed by browser via https, users need to be able to access data stored on a server in a MySQL database. Data has to be encrypted for several groups of users, where one group ...
3
votes
2answers
165 views

Is there a strong reason to salt and hash passwords when password reuse is not an issue?

I am dealing with a system (in development) that uses randomly generated (not user provided), unique, strings to authenticate services that will consuming an API. Right now, these strings are stored ...
2
votes
3answers
370 views

Can an unlisted directory on webserver be discovered?

Assume the following sample directory: - / - /images - /28374728127636438 - /css Directory listing is disabled on the server and the directory named 28374728127636438 never linked anywhere on the ...
1
vote
2answers
54 views

How secure are SSL client certificate authentications? [duplicate]

As far as I understand it's possible to issue SSL certificates, which could be used by clients for authentication. So in theory only users with valid certificates would be able to access a certain web ...
1
vote
2answers
93 views

How to secure a web service for web applications using same database?

I have 2 or more web applications that need to be able to communicate together using a web service interface. Information All applications are using TLS/SSL (https) All applications have access to ...
0
votes
2answers
72 views

How the address bar manage the XSS?

I was playing with OWASP Mutillidae II and in one page I've found one vulnerability. In the address bar I've wrote something like : ...
1
vote
3answers
77 views

Is PGP suitable for encrypting webservices?

I would like to know if I can use of PGP to ensure SOAP webservices confidentiality? I don't want use SSL, it's kind of slow mechanism to make a tunnel for high throughput data transaction. I though ...
0
votes
1answer
43 views

Why do people trust PlayFramework2 dependency management?

If you worked in a big company that was very security conscious, would you build a product based on PlayFramework2 underneath? Since it does automatic dependency resolution at load time, aren't you ...
1
vote
2answers
69 views

Is there a secret-sharing public-key-encryption-based service? [closed]

I need to share some sensitive information with someone else who can only communicate via E-mail. I don't love the idea of sharing this information freely over email in plain text, so I was ...
1
vote
0answers
35 views

Properly secure an API [closed]

I'm working on an application that basically match (IRL) two kind of persons. On the client side, the frontend is a single page application with a flow that looks like this: Details -> Login -> ...
0
votes
2answers
109 views

Securing Public Web Services - What is the best practice? [closed]

There seems to be a number of ways to secure web services. OAuth, API Keys, Tokens, WIF, etc. Since security is not my area of expertise, I am asking what is the best ways to secure public web ...
0
votes
1answer
90 views

Securing REST API that will accessed from different clients

I have developed a REST/JSON API. The API exposes a lot of features. The API will be consumed by applications we design internally (mobile apps and web apps), by applications designed by our resellers ...
0
votes
2answers
73 views

Best practice for two WebServices that have to authenticate with each other [closed]

I have two WebServices that are hosted by two different applications. Both Applications access each other's webservices: Now both WebServices have to authenticate with each other. Different ...
2
votes
2answers
157 views

Is this token based web service secure?

Note: Original question asked at http://stackoverflow.com/questions/24012390/is-this-token-based-web-service-secure but here seems to be the right place for it. The company that I current work for ...
0
votes
1answer
204 views

Force download files protected with auth headers

By several REST clients the credentials are sent with every request through custom HTTP authorization headers to the REST service. Is there a way to force file download in the browser when accessing ...
0
votes
1answer
30 views

Safely converting untrusted files with Microsoft Word in a web service

I'm made a small web service that gets urls, download them, and convert them for another format. Most of those urls are documents (doc, docs,...). Basically, I'm open them with MS-Word and convert ...
6
votes
4answers
423 views

Is it secure to use *no authentication* for services listening only on localhost?

I have many applications installed on my server that use a webui frontend to control the application. Since I am the only user of the server, I usually bind these applications to 127.0.0.1. As the ...
-2
votes
1answer
293 views

Can a sysadmin spy on a Wifi connection? [duplicate]

Is it possible that someone who is in charge of a network serving many users, can see what site we visited? I mean, we have only one internet connection, and we used WiFi to be connected. Is it ...
1
vote
0answers
215 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
1
vote
1answer
67 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
2
votes
1answer
218 views

Security in large-scale SOAs

Let's assume a service-oriented architecture (SOA) with hundreds of services. The services are completely isolated – what is behind their APIs is an implementation detail. Different services can have ...
3
votes
1answer
1k views

Encrypt Android app data and send to web service

I want to develop an Android app that may contain sensitive personally identifying information (national ID number, phone number, etc.) among other data that will be stored in an Android phone. Let's ...
1
vote
1answer
120 views

Is it illegal to publicly reveal security flaws in a service? [closed]

Mainly I'm interested in UK law on this, but I welcome input from any jurisdiction. I discovered flaws in a service that undermined the security of all its user's data. This is a service where users ...
1
vote
1answer
263 views

What popular online services allow passwordless authentication using digital signatures? [closed]

I am looking for web services that allow clients to authenticate using digital signatures. Especially with e-commerce and payments, clients generally authenticate using name and password (sometimes ...
1
vote
2answers
371 views

REST security standards

As far as I know, SOAP services have security standards recognized by OASIS and W3C, such as: XML-Encryption XML-Signature SAML Are there any security standards for RESTful services?
12
votes
2answers
542 views

How can I prevent that my users get a certificate issued for my domain on my behalf?

I have a domain, where some other users have access to upload files, use email, use XMPP, etc. How can I prevent that these users go to a certificate authority and get a certificate for my domain? ...
2
votes
1answer
182 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
1
vote
1answer
121 views

Is this where a nonce comes into play?

I'm reviewing a website a friend developed, and was looking for general errors and concerns. In reviewing I noticed he is very heavy on ajax calls using JSON to a RESTful API that he maintains on a ...
0
votes
1answer
65 views

Is it reasonable to use a security proxy when integrating two web applications?

Background: We're in the process of integrating two web applications. The other one, application A, is a publicly accessible Internet service, which is provided by a third party and which offers Web ...
2
votes
1answer
2k views

Authenticating Users from Android with PHP Webservice

I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice. But I'm a little confused over the authentication scheme. I ...
1
vote
2answers
1k views

POST over HTTPS “secure enough” for sensitive data?

I'm wondering if to prevent the possibility of a compromised SSL certificate leading to the potential for sensitive information disclosure if it might be prudent to further encrypt data being passed ...
-1
votes
2answers
132 views

Are there any mail services that don't store encryption keys?

According to this article => http://www.howtogeek.com/166507/why-most-web-services-dont-use-end-to-end-encryption/ Gmail doesn't store the encryption key. But Gmail reads whole of users' email for ...
1
vote
1answer
71 views

Blocking Internet Monitoring Software

So if a provider has software that blocks you from using their internet to connect to, say, Spotify or Skype. Is there a way to block your computer from communicating that this program is running? Or ...
1
vote
0answers
79 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
2
votes
1answer
267 views

HMAC needed with SSL/AccessToken in place?

Is using an HMAC in web service messages overkill if you are already using SSL and Access Tokens? I’m thinking of further ways to secure a service, and HMAC message signing is one. But it comes with ...
1
vote
2answers
136 views

How to securely provide data to a web server using a data warehouse?

We have a data warehouse that stores prices for our products. Once every business day, new data points are added representing the day's price for each product. On the website, a user sees this ...
-1
votes
2answers
112 views

Executing PHP WeService script by clicking a link within an e-mail

I'm receiving e-mail from my PHP/MySQL application with certain links. I was thinking on including an UUID as part of the link, which would point to a Web Service that ONLY reads those UUIDs. Those ...
3
votes
1answer
118 views

Storing product keys on same server as shop?

Situation: An e-commerce system (specifically: PrestaShop) which is used to sell virtual products (specifically: product license keys). To accelerate order processing, a cronjob is supposed to be ...
4
votes
1answer
912 views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile website to make my service also available for other mobile operating systems. Now, ...
0
votes
1answer
100 views

Service TO Service Authentication & authorization [duplicate]

I have two web services A and B the requests between those services is http. I want so establish a secure connection between service A and service B to ensure the authorized and authenticate request ...
1
vote
1answer
158 views

How do you limit javascript api to a domain?

Ok, many of you now the scenario: you login to developer.sayLinkedIn.com, create an app with credentials and define the domain in witch that key is allowed to "run". The question is, from a api ...
0
votes
3answers
121 views

Does semi-sensitive information demand encryption / security? [closed]

Since it's been requested that this question be rewritten: Is SSL (or some other encryption equivalent) required in the below case? From a small local business website, is there any damage that an ...
1
vote
1answer
197 views

Is it possible to create secure streaming server

Right now I am thinking for a way to create a secure video streaming server with the following assumption: people can be trusted not to distribute the video they have rights to see. (I think in ...
0
votes
1answer
58 views

Decentralized online shopping service [closed]

Would it be possible to create an online shopping service like Amazon (or Silk Road) but also to make it decentralized so there would no main server users would have to trust with their data? I ...
1
vote
0answers
80 views

Untrusted central server and self-hosted/local client

I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
1
vote
2answers
222 views

API - Security design issues

I'm building a GUI Desktop application that will communicate with an API(http) in a webserver. In the client side I have a GUI Desktop application and a GSM Modem(hardware). The GUI Desktop ...
-1
votes
1answer
185 views

Location of server affects the speed of page loading? [closed]

i live in a country but i make a website for another country's users. The web hosting company has server in both of the countries. So where should i buy? Does it affects where the server is depending ...