A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

3
votes
2answers
366 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
2
votes
1answer
360 views

Sending data from Android client to database

I have created an Android app which sends data to a web service (wcf). Right now the user sends his test result (test id, test name, test time and user ID. The problem is that I send the data from the ...
2
votes
0answers
27 views

Patterns for asynchronous authentication (after message is sent)

I'm looking at a scheme where users/servers post messages to each other. One of the main challenges is to prove "ownership" of a URL - defined as the ability to receive messages. This can be done ...
2
votes
0answers
38 views

Security implications of providing an encryption/decryption oracle

I need to provide a service that acts as a symetric encryption/decryption blackbox : the box get a secret key k users send datas d, and get ciphertext c = Encrypt(d,k) users send ciphertext c, and ...
2
votes
0answers
73 views

Correct approach to secure the back end service - oAuth

I'm developing a OAUTH service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants. basically users can purchase goods from Merchant's E-Commerce ...
1
vote
0answers
69 views

How to secure requests to my API from my web widget embedded in third party website

Background I'm designing a web widget for a new SaaS for embedding in a password-protected CMS. This would allow the customer to add something like the following to all the pages in their CMS to ...
1
vote
0answers
83 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
1
vote
0answers
125 views

Is generating custom authentication token for WCF service requests a good practice?

I have public WCF web service which works over https. There are lots of technical restrictions on client side, so I can't use any advanced schemes like oauth. I have registered users and some of them ...
1
vote
0answers
174 views

Secure Requests Between iOS App and PHP Server

I'm developing an iOS app that requires data to be sent to a server to process a transaction. The data is stored on Stripe (A credit card service) so I do not need to worry about encrypting / storing ...
1
vote
0answers
297 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
1
vote
0answers
121 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
1
vote
0answers
103 views

Untrusted central server and self-hosted/local client

I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
0
votes
0answers
51 views

Comparing Oauth and JWT auth in my web application

I have created an e-commerce website which has a REST API on the server side and Angular on the client side. I am considering to use OAuth to secure my API, but it seems to overkill because I have no ...
0
votes
0answers
69 views

Web service security - authorization

I am trying to look for state-of-the-art approaches to do authorization to secure web services and SOA's in general. I found the following two articles while searching: link1 and link2. I find that ...
0
votes
0answers
153 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...