1

I have 2 or more web applications that need to be able to communicate together using a web service interface.

Information

  • All applications are using TLS/SSL (https)
  • All applications have access to the same database and that database can only be access by these applications

My problem is that I don't want anyone else to be able to use the web service. Meaning that only the applications should be able to call the web service to get information or execute an action on another application.

Is there any "simple" way to do that?

I figured that since only the applications have access to the database, I could probably use it as a trusted third party to validate the identity of the one calling the web service.

EDIT

There was some confusion with the current setup so here are some additional information

  • The applications and the web service are the same thing. Each application define a web service interface to enable the other applications to communicate with it
  • The applications and the database are all hosted on the same server and it's a dedicated server that only host those applications and that database and it is run by "myself"
  • All the applications are secure and require authentication to be used
  • I need to use a web service instead of using the database to communicate between the applications because each applications is using a different language and the business logic is all in the applications code. This business logic code need to be called when the applications communicate together.
  • Will both of these web application be consuming the web services from servers with static IP's? – ilikebeets Aug 28 '14 at 19:06
  • @ilikebeets Are you suggesting to simply verify the IP of the caller? I'm not sure that is a secure scheme. What about IP spoofing? – Gudradain Aug 28 '14 at 20:15
  • No, not at all. But doing that in combination with other methods could help. Multiple layers of security is never a bad idea. If you can prevent any people or systems that should not make API calls from seeing and accessing the API in the first place, you have a fairly strong first line of defense. – ilikebeets Aug 28 '14 at 20:19
3

My problem is that I don't want anyone else to be able to use the web service. Meaning that only the applications should be able to call the web service to get information or execute an action on another application.

Is there any "simple" way to do that?

There are several ways. You say you use HTTPS; so you can add a simple authentication scheme (shared secret) with very reasonable safety. I assume the applications themselves are secured.

You can also perhaps employ client certificates for the SSL conversation (i.e., the SSL channel also supplies identity certification). Depending on your setup, it might be easier to implement than adding authentication to the web service.

Possibly, you can use an authenticating proxy. This requires a more awkward setup, since you're in practice using the proxy to run a man-in-the-middle attack against your own SSL connection. Or you can use some sort of web service-aware front-end developed for that purpose, that would do essentially the same (identifying itself as the real web service, then passing the connection to the real web service after removing extra authentication information).

In all cases, you can reduce the attack surface by routinely denying access to the services at the IP level, unless the requests come from a neighbourhood of known application installations.

A specialization of this approach would be to establish a full VPN between applications and web service. This would have the advantage that neither apps nor web service would require any substantial modification, but would come at some performance cost (you're running an encrypted connection inside another).

I figured that since only the applications have access to the database, I could probably use it as a trusted third party to validate the identity of the one calling the web service.

You can, but at that point your applications are already communicating with the system running the web service through the database. Whatever channel you're using for the database, you can either use that same channel/method, or you should suspect it to be insecure.

For example, the applications (or the service) are now accessing an external database server - can anyone access that server? If yes, you might have some problems right there. If not, which is more likely, then why? (And I guess the answer is "SSL encrypted connection, password/certificate authentication, and/or IP verification, or full VPN").

Update

In your setup, the applications and the web services they expose are on the same machine (this is not so common, which is why I hadn't thought of the possibility). This allows for 'trivial security' -- i.e., you can expose the web service interface(s) on 'localhost'. You can even use them in the clear, dropping SSL altogether, since localhost communications won't leak outside the machine. And to intercept them one would need a sufficient level of access to the server that the point is moot anyway.

If you want, or if you ever need that, you can also expose a (different?) web service on the external interface, and run that endpoint with authentication and SSL security (possibly with client certificate check also).

As things stand, it seems to me that you are already secure. Just check that the applications/frameworks/servers default configuration does not include binding to any interface (it is very often the default), because that would potentially allow access from outside.

  • Good answer. I updated my post to clear some of your interrogations. – Gudradain Aug 29 '14 at 12:49
0

If you were using WCF you could use authentication to only allow specific users run specific methods. I use this in an intranet envoironment. I am not 100% but this might be a good starting point to use WCF or find an equivalent method in whatever technology you are using to call methods.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.