A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't ...

learn more… | top users | synonyms

-2
votes
1answer
142 views

What scenarios really benefit from signed JWTs?

UPDATE: I have concluded my research on this problem and posted a lengthy blog entry explaining my findings: The Unspoken Vulnerability of JWTs. I explain how the big push to use JWTs for local ...
3
votes
0answers
65 views

How safe is WebCryptoAPI these days?

The 1Password Tool (software) introduced the 1Password for Teams. Now I thought this is a great peace of Software. But now they can show Passwords in the Browser. They do say: We encrypt ...
2
votes
0answers
55 views

Patterns for asynchronous authentication (after message is sent)

I'm looking at a scheme where users/servers post messages to each other. One of the main challenges is to prove "ownership" of a URL - defined as the ability to receive messages. This can be done ...
2
votes
0answers
52 views

Security implications of providing an encryption/decryption oracle

I need to provide a service that acts as a symetric encryption/decryption blackbox : the box get a secret key k users send datas d, and get ciphertext c = Encrypt(d,k) users send ciphertext c, and ...
2
votes
0answers
306 views

How to secure requests to my API from my web widget embedded in third party website

Background I'm designing a web widget for a new SaaS for embedding in a password-protected CMS. This would allow the customer to add something like the following to all the pages in their CMS to ...
1
vote
0answers
37 views

Securing promotional discounts

I have a service, offering a physical good in exchange for either money or via code given out by us. The service is accessed through a mobile application. The codes have usage restrictions, for ...
1
vote
0answers
51 views

Are Web Services vulnerable to CSRF?

I'm testing an android application, it uses web services for every action, so I saw the requests don't have tokens or another anti-automation mechanism, they just need to validate a token to identify ...
1
vote
0answers
29 views

central auth servers and in-app password changing

BLUF: philosophically, when (if?) should (web) services that use a central auth server add the power to change passwords? Simplified definitions, for the sake of this question: Central Auth Server: ...
1
vote
0answers
158 views

Firewall requirements for SaaS service providers

I have not had much success compiling a workable overview on the topic of firewalls and application service providers, despite making a rather extensive contribution to Google's workload this month. I'...
1
vote
0answers
243 views

Is generating custom authentication token for WCF service requests a good practice?

I have public WCF web service which works over https. There are lots of technical restrictions on client side, so I can't use any advanced schemes like oauth. I have registered users and some of them ...
1
vote
0answers
160 views

Correct approach to secure the back end service - oAuth

I'm developing a OAUTH service (I'm thinking so. It might not be exactly the same.) to open one of our back end API to a Merchants. basically users can purchase goods from Merchant's E-Commerce ...
1
vote
0answers
245 views

Secure Requests Between iOS App and PHP Server

I'm developing an iOS app that requires data to be sent to a server to process a transaction. The data is stored on Stripe (A credit card service) so I do not need to worry about encrypting / storing ...
1
vote
0answers
353 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
1
vote
0answers
160 views

Need help to Webservice in Axis2 with https in java

I have written my webservice with https. but as per requirement i should provide authentication. so thought of going with https ssl. could any one help me with steps like moving http to https and ssl ...
1
vote
0answers
125 views

Untrusted central server and self-hosted/local client

I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
0
votes
0answers
39 views

Mitigation for web service that may impersonate the context of native application?

I am trying to create threat model, and I have one of the threat listed as follows: Web Service - may be able to impersonate the context of Native Application. Can some one please help to ...
0
votes
0answers
58 views

Framework to authenticate web API requests from legacy application

I have a legacy ASP.NET MVC application that uses pretty standard forms authentication which validates logins against an application database. The scope to change this application is limited, however ...
0
votes
0answers
40 views

Web service authorization to specific applications: certificates, embedded secret or both?

My needs are somehow similar to this answer, but I would to be more specific. I have a set of web applications (A and B) that access to a REST service (R). A, B and R could be on the same server or ...
0
votes
0answers
62 views

JSON Web Token Security RSA

We are planning to use JWT (JSON Web tokens) in an application project, which is a set of multiple distributed web services allowing SSO authentication (single sign on). So there is a single central ...
0
votes
0answers
16 views

Is it ok to use one key pair for my authentication endpoint?

I have an web endpoint that checks user passwords, then issues signed JWT tokens to the client if password matches what we have in the database. The JWT is signed with a RSA private key using RS512. ...
0
votes
0answers
21 views

Denial of service async Web service

Is it possible to perform a denial of service attack on an async service? Isnt the operating system supposed to release the thread? Im thinking it doesn't't matter as someone attacking a system would ...
0
votes
0answers
237 views

Using WCFs WS-security implementation, how can the server verify client identity?

Using the configuration below we have implemented message security using WCF and WS-security. Note that we use clientCredentialType=Certificate. Now my questions are: Does the configuration below ...
-3
votes
0answers
31 views

How to achieve end-to-end security in a Browser-Server architecture?

Let's assume a typical web application with a back-end and a front-end(e.g. a MVC framework using PHP or Python). As far as I have studied and please correct me if I am wrong, it is not a typical ...