New answers tagged web-service
One way to attack this would be with a replay attack. If I get hold of the message I can re-send it and the server would think that I'm an authenticated user and will grant me access. This can be solved with server sending a challenge(e.g. one-time token). The challenge needs to be included in some way together with the username and password. Important is ...
Top 50 recent answers are included