Implementing secure login for an API

Question

I am implementing a web api with which I plan to authorize access by accepting a username and password and system name and returning a sessionid which can be used on subsequent calls to authorize the caller.

The api is only available though SSL 3.0 or TLS 1.0.

What are the main attacks which would be possible in this scenario?

The answer and comments to this SO question seem to indicate that if the risk of attack is proportionally low, more complexity will not improve security but will add complexity. I would like to know the highest risk areas for attack to determine the appropriate counter-measures, if necessary.

Answer 1

This is a very broad question that can't be answered with anything near sufficiency on Stack Overflow. You really need to read a book to understand all of this. I highly recommend the Web Application Hacker's Handbook. It is an interesting and informative read.

Broadly speaking, you need to worry about people stealing or guessing the session ID. There are many different ways to do that. Make sure you are protected against XSS, CSRF, and that you are generating session IDs with sufficient entropy and randomness. Don't fall into the trap of using the current time value either. Those are surprisingly quite predictable.