A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

2
votes
2answers
174 views

End to end security for REST services, any emerging standards?

I work with integration in the healthcare sector, where end-to-end security is important. We integrate with numerous SOAP services, and use the WS-security features to encrypt and sign requests and ...
2
votes
0answers
45 views

Patterns for asynchronous authentication (after message is sent)

I'm looking at a scheme where users/servers post messages to each other. One of the main challenges is to prove "ownership" of a URL - defined as the ability to receive messages. This can be done ...
2
votes
0answers
51 views

Security implications of providing an encryption/decryption oracle

I need to provide a service that acts as a symetric encryption/decryption blackbox : the box get a secret key k users send datas d, and get ciphertext c = Encrypt(d,k) users send ciphertext c, and ...
2
votes
0answers
120 views

Correct approach to secure the back end service - oAuth

I'm developing a OAUTH service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants. basically users can purchase goods from Merchant's E-Commerce ...
1
vote
0answers
24 views

central auth servers and in-app password changing

BLUF: philosophically, when (if?) should (web) services that use a central auth server add the power to change passwords? Simplified definitions, for the sake of this question: Central Auth Server: ...
1
vote
0answers
182 views

How to secure requests to my API from my web widget embedded in third party website

Background I'm designing a web widget for a new SaaS for embedding in a password-protected CMS. This would allow the customer to add something like the following to all the pages in their CMS to ...
1
vote
0answers
139 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. ...
1
vote
0answers
191 views

Is generating custom authentication token for WCF service requests a good practice?

I have public WCF web service which works over https. There are lots of technical restrictions on client side, so I can't use any advanced schemes like oauth. I have registered users and some of them ...
1
vote
0answers
212 views

Secure Requests Between iOS App and PHP Server

I'm developing an iOS app that requires data to be sent to a server to process a transaction. The data is stored on Stripe (A credit card service) so I do not need to worry about encrypting / storing ...
1
vote
0answers
321 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
1
vote
0answers
143 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
1
vote
0answers
115 views

Untrusted central server and self-hosted/local client

I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
0
votes
0answers
7 views

Denial of service async Web service

Is it possible to perform a denial of service attack on an async service? Isnt the operating system supposed to release the thread? Im thinking it doesn't't matter as someone attacking a system would ...
0
votes
0answers
74 views

Using WCFs WS-security implementation, how can the server verify client identity?

Using the configuration below we have implemented message security using WCF and WS-security. Note that we use clientCredentialType=Certificate. Now my questions are: Does the configuration below ...
0
votes
0answers
109 views

Comparing Oauth and JWT auth in my web application

I have created an e-commerce website which has a REST API on the server side and Angular on the client side. I am considering to use OAuth to secure my API, but it seems to overkill because I have no ...