3

I am developing secure payment APIs, i want to avoid manipulation of API parameters and fired same API again. For example, following is the API call

https://api.payment.com/wallet/transfer?from_account=123&to_account=456&amount=100

Once this API call is executed, someone with enough knowledge can execute the same API call by modifying any of the three parameters to his/her own advantage. I have thought of issuing a temporary token (transaction token) for each transaction. But this also doesn't sounds like enough.

Can anyone suggest the best way to achieve this?

Improve this question

1 Answer 1

Reset to default
4

Your request, at least how you describe it, isn't authenticated. This means that anyone at any time can send such a request and trigger a transaction.

I assume that TLS is a given, as you are using HTTPS in your example URL. This is of course a must have.

You need to implement the following mechanisms to protect your API against this problem:

  1. Authentication: You should authenticate the user sending the request. There are many different authentication protocols available and the right choice depends on your architecture. It can be something straight forward like basic authentication or something more complex like a token based OAuth implementation.

  2. CSRF Preotection: Again, I don't know your application architecture, but in case you have a web-frontend that triggers the API calls, CSRF might become an issue. In this case you must also ensure that CSRF protection is in place to avoid missuse.

  3. Replay Protection: After implementing 1. and 2., you have to evaluate, if there is still a risk of replay attacks. If that's the case, you have to implement a scheme that ensures that a duplicate gets detected (e.g. every request has a random id that gets tracked).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .