Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Filter by
Sorted by
Tagged with
0
votes
1answer
29 views

How to implement token based authentication for my API? [on hold]

I have a Django backend which will be served as my API endpoints. Users are identified by username and password and have some extra information and should be able to consume my same API, so I want to ...
1
vote
1answer
67 views

Is adding a prefix to an API token lowering it's security

When creating API tokens, one can pick any format one likes. Many people choose to use SHA1/SHA256 of random bytes or just random characters. I'm wondering how much of a security issue is to prefix ...
0
votes
0answers
22 views

Configure gRPC with Burp Suite

I have been given a task to do security auditing of the APIs which are running in gRPC. I am using BloomRPC for querying the gRPC Services. But there so no such option in BloomRPC to proxy the ...
0
votes
2answers
52 views

Scraping data from a form submission on another domain

I’m currently researching a possible security vulnerability I may have found on a well-known website. Before I present to the company, I’d like to build a proof of concept. I’m looking at a site (...
1
vote
0answers
40 views

Integrating web applications into our payment API. How to ensure the integrity of the payment process?

We will be creating a brand new application soon that handles online payments for our firm. We now have several different web applications (in different technologies) running that will all be ...
1
vote
0answers
57 views

Security aspect in the API gateway area

I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level. Scanning REST APIs (see http://docs.w3af....
0
votes
1answer
43 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
0
votes
0answers
18 views

Secure API and User Data both with Oauth2.0

We are currently looking at adding API endpoints for a third party to consume and the endpoints will be concerning individual user data. The current proposed security architecture is to use Oauth2.0 ...
0
votes
0answers
26 views

Can I rely on Google id_token for web session?

I'm building a website without a "server": JavaScript and AWS Lambdas as back-end through API Gateway. Knowing there is no solution for session when using lambdas, I was wondering if I could only use ...
1
vote
1answer
123 views

Is it a major security risk if your client_secret gets displayed for about 30 min - 1 hour before you notice it showing and you can remove it? [duplicate]

Did something stupid, and asked a question on stackoverflow posted a little too much info without realizing it. Is it a major security risk if your client_secret gets displayed for about 30 min - 1 ...
0
votes
0answers
57 views

nonce encryption in https

I am thinking about using nonce and secure request to API Server. Is this the right implementation for using nonce? PURPOSE Protect API Server from Replay attack Protect API Server from MITM attack ...
0
votes
2answers
92 views

Rest API Sensitive Data GET

We are trying to decide the best approach to designing our new interface with our consumers. Currently we are talking about an Rest API. However there is some debate among our team about how to ...
0
votes
1answer
51 views

SSL certificate distribution of API

We have an API which has SSL certificate signed from authorized CA. The access to the API is limited. API is accessed from webapp and only from those client who have valid public key for SSL. Now, how ...
1
vote
1answer
76 views

Security and the Definition of Ready and Done [closed]

Currently I am in a project where I have to test REST APIs among other things. In another question of mine I also discussed the topics Definition of Ready and Definition of Done regarding security. ...
0
votes
2answers
108 views

Rest API Security Guideline. Developer Rules? [closed]

In my current project I am also setting up the area of security testing. So far there was no way to use security within the REST API development. Beside the known approach, e.g. using static software ...
2
votes
2answers
124 views

Generate API keys with JWT and regenerate the same key when needed

I recently found my self in need of developing a public API for my application. I developed my application with node.js and MongoDB. After some research, I decided to use jwt for generating API keys ...
1
vote
2answers
56 views

Security considerations of consuming public API

I have a website and i want to consume public API from third party services such as Zoopla, weather etc. I want to ensure i do not consume malicious code/malware from the data retrieved from the 3rd ...
0
votes
0answers
69 views

Should I hash responses from server?

I am hashing all requests to my server with a secret token known by only the server and my mobile app to prevent malicious apps from using my servers. Should I also do this on the responses from the ...
1
vote
0answers
49 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
2
votes
1answer
89 views

How to securely share sensitive info (such as API keys) with freelancers?

My business partner and I are building a webapplication. We have partnered with some third party services which make use of API (public and secret) keys. The freelance developer we worked with ...
1
vote
1answer
43 views

How to secure embedded code containing REST api call

I am making a Google Analytics like service where you embed generated code into your website and it tracks certain data. I have a backend REST api, but I am not sure how to securely implement a call ...
0
votes
0answers
33 views

Public report/telemetry API

I want to implement a telemetry data sender into my electron app. The API which I want to connect to is public. So any crash reports or any other data from the user is sent to it. The problem is how ...
0
votes
0answers
16 views

Server to Server API Security [duplicate]

Background I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote ...
0
votes
0answers
52 views

How does Google restrict API access by mobile App ID?

Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers. How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
0
votes
0answers
56 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
0
votes
1answer
34 views

Securing implicit tokens (Example: Moltin)

I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token. Basically they provide you with a read-only (for the most part) ...
1
vote
1answer
100 views

Secure endpoint for root domain only, no subdomains

I have an existing endpoint, for example https://api.example.com/ ... I have an existing CORS policy enabled which only allows access from origin example.com. However, when I visit the endpoint URL ...
3
votes
1answer
123 views

Storage of API authentication token in single-page-applications

I'm building a JSON API. For authentication I plan to use a random-token based approach, with the random token having 256 bits of entropy and generated using a CSRNG. A hash of the token will be ...
1
vote
1answer
215 views

Exploitability of allowed wildcard (*) CORS Origins with Bearer Token Authorization [duplicate]

I'm looking at the following setup. A web application uses a REST API to communicate with the server. All API responses include Origin: *. For authorization Authorization: Bearer <token> is used....
0
votes
2answers
99 views

Can wireshark capture the exact payload and end point of API used by my Mobile APP?

I was just wondering if someone having total control over his/her network, is running my mobile app. Also wireshark is capturing all requests made using the network. My app is calling API endpoint ...
1
vote
1answer
205 views

Swagger on production APIs

What security issues could arise from leaving the Swagger pages on production APIs that expose sensitive data (albeit secured with OAuth)? Are there web crawlers that look to harvest Open API ...
0
votes
0answers
38 views

REST API Basic Authentication Use Case

I'm developing REST APIs and would like to know if Basic Authentication will be enough to secure them, or if I should be looking into other authentication methods, like OAuth2. My APIs are setup to ...
0
votes
3answers
89 views

How to limit web API microservice communication to specific list of machines?

I have an PHP API that I want to be consumed only by one static website. However the HTTP is not secure as from what I suspect any header can be spoofed (IP - I may be wrong here, domain name, and so ...
0
votes
0answers
48 views

Is it safe to use Giphy API keys in public Github repo?

I am making a game of which one of the hidden features is displaying a GIF from Giphy at a fixed command. For this, I am using Giphy API, hosting the game as a website on Github Pages with a public ...
0
votes
0answers
59 views

Using Mutual TLS to create api keys

I would just like a sanity check on my plan to implement API authentication/authorization. Authorized URLs are placed in a secure DB The client server places a GET request to api-key service with ...
0
votes
0answers
43 views

Is it possible to extract data from api response from main domain?

I found an XSS on subdomain.example.com, is it possible to use that xss to extract the response of an api request from the main domain example.com/api/xyz? The xss is on subdomain.example.com and I'd ...
1
vote
0answers
35 views

Is there away to retrieve results (including found vulnerabilities) of a specific scan from one API call?

Is there away to retrieve results (including found vulnerabilities) of a specific scan from one API call? From InsightVm documentation, the GET scan API call returns only scan info with statistics of ...
0
votes
1answer
47 views

Whats should be TRACE response of an API (if it is not allowed on server)?

I am testing a website and noticed that when I change the GET method of the API request to TRACE, it returns an error 405-Method not allowed in Burp repeater. That's fine. The problem is, lots of ...
0
votes
0answers
28 views

Make an internal API to return client_secret and server token

Given there's an internal API for a URL, how can you make it return client_secret and server token (possibly other sensitive info)? This question is influenced by a bug report filed on hackerone.com ...
1
vote
0answers
63 views

Payment gateway API authentication

I've been tasked with building an API that interacts with a couple of payment gateways to create payments. The API has accounts with multiple users and the accounts have payments associated with them....
0
votes
0answers
41 views

what would be the best approach to generate JWT token for server to server communications?

I am planning to develop an authentication service which generates and validates the JWT token for incoming requests. What would be the best challenge mechanism which could be employed to generate the ...
1
vote
1answer
140 views

Should I report this Google API key disclosure issue or not?

I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to: https://www.googleapis.com/customsearch/v1/...
0
votes
0answers
37 views

Does an OAuth1.0a HTTP GET endpoint in my API present a security vulnerability?

I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites. My application can post to Twitter on behalf of a user. This required implementing ...
4
votes
1answer
98 views

API pentesting for mobile and web. What's the difference?

So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it'...
2
votes
4answers
102 views

How to stop people from spamming the account creation url on my website [duplicate]

let's say I have a website with an account creation form. How can I stop people from writing a program that automatically submits the form thousands of times, which would fill up my database with junk ...
1
vote
1answer
220 views

Why is PKCE secure against man-in-the-middle attacks?

In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
1
vote
0answers
99 views

Is having multiple access tokens valid at the same time a security risk?

I run an API that allows multiple access tokens (JWT) to be valid for the same account, in order to allow users to sign into the web application and mobile app at the same time. Is this a potential ...
0
votes
0answers
52 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
1answer
39 views

Secure Exchange Rate for Restful API

I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another ...
0
votes
1answer
80 views

Subdomain api.domain.com - more vunerable to attacks?

I am in the process of setting up an api which will have the subdomain "api.", I have been advised to change this to something "less obvious" to avoid automated attacks against it. I can't find any ...