Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

0
votes
0answers
7 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
2
votes
1answer
73 views

Unauthorized API Access Without Key Header

In order to test the security of my API, I want to act as sort of an attacker in order to try and gain access to my own API without an API key. In order for me to send requests to this endpoint, I ...
1
vote
0answers
27 views

Is it safe for a service to share memory addresses with remote clients?

Supposing a remote service has the following data structures (using C++ as an example): struct Item { std::string name; struct {} whatever_else; }; std::map <std::string, Item *> ...
4
votes
2answers
99 views

Rate Limiting An API

I am busy developing an API for a mobile application, currently one of the endpoints require that the users username and password be POST'ed to it. What I am worried about is someone discovering that ...
1
vote
1answer
97 views

AES Encryption is this overcomplicated encryption?

I'm working with a vendor's API and it recommends the following steps for transmitting an encrypted value: 1) Convert the encryption password to a byte array. 2) Convert the value to be ...
0
votes
0answers
30 views

How to properly store OAuth 2.0 client_id and client_secret in a web application?

In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
0
votes
0answers
12 views

implementing push api for files using oauth2

i want to implement a push api similar to Garmin Connect API. this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created. we ...
4
votes
1answer
79 views

How do I implement a Microsoft Login into my own website? [closed]

I am trying to make a website, which hosts a form for employees to enter their shift details into. The website itself is pretty basic, meaning it is mostly just HTML and PHP code. Obviously I need to ...
1
vote
1answer
46 views

CORS accepting arbitrary origin with GET but not with OPTIONS

I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *. However, with OPTIONS requests and an arbitrary origin, ...
2
votes
2answers
75 views

How to protect API endpoint from abuse in mobile App?

Let's assume I have a mobile app that fetches the news feed from an url on my server. GET/ https://example.com/api/v1/newsfeed Is there a way to restrict the access to this endpoint to only from ...
0
votes
1answer
166 views

Access-Control-Allow-Origin wildcard doesnt allow sending session cookies

I always thought CORS restrictions was to disable the following scenario: I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/...
1
vote
1answer
40 views

Protect app from Http Proxy like Charles [duplicate]

I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
0
votes
1answer
120 views

What all test cases/vulnerabilities we need to try in REST API Pen testing?

I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API. I have gone through the OWASP resources ...
10
votes
2answers
2k views

Public API with authorization token — is it possible to protect the demo token?

I have a REST API for running some calculations and returning the result, with a very simple token system where only authorized users can use the API. The user adds their token to the query like this:...
2
votes
1answer
67 views

Is it ok to use the same SSL certificate for both HTTPS and SOAP-level signing/encryption?

I'm currently looking after an integration platform with SOAP based web service connections out to partner organizations. At the moment, the same SSL certificate is used for both transport level ...
0
votes
3answers
95 views

Is it better to rate limit API requests based on UserId or IP address for authenticated users?

I'm thinking of rate limiting anonymous requests based on IP, but for users with a valid authentication token, I can't decide if it's better to log and rate limit requests based on their UserId or IP ...
1
vote
0answers
28 views

Nested API security

What are best practices for securing nested APIs? Here is an example: User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet) Typically,...
1
vote
1answer
29 views

What methods can I use to prevent a public API's limit bypass?

So let's say that after 50 requests in a period of 30 seconds, a user's IP gets blacklisted. They can still bypass this block by changing their IP, which is quite easy and fast nowadays. So, what ...
1
vote
0answers
84 views

How to bypass a public API's usage limit block? [closed]

I'm trying to build a database with information that I can get with a lot of http GET requests to the target server's API. The problem is that they obviously do have restrictions. After 80+ requests,...
1
vote
3answers
75 views

Why allow a public API Key to change?

A common method of credentialing for an API is to give each use a public/private key pair. The public key is sent in with the request, and the private key is used to sign the request (and is verified ...
1
vote
1answer
128 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...
0
votes
0answers
14 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
2
votes
0answers
81 views

Disable Google API key without access to google account

I was trying the new google api - I created anonymous account - added there my debit card, set up the API key for google maps. Tried API and pushed my API key to shared repository (yes I know - my ...
9
votes
3answers
360 views

I don't understand what's wrong with just using cookies for authentication?

I'm writing an app-server and there is an option to just use secure cookies for authentication. Here's how it seems to work: You define a 32-byte secret key on the server When the user logs in, you ...
2
votes
1answer
108 views

Is OAuth appropriate for a private API to be used by registered customers?

I am developing a private API that will be used by pre-registered clients to access information on our website. We will be storing their login credentials on our server. When looking into how to ...
2
votes
1answer
95 views

Allowing unauthenticated user access web page information

Our web application should allow unregistered users to browse certain information. This information is returned by apis Currently we are using hardcoded guest login to achieve this The mere ...
1
vote
1answer
92 views

API Key in microservices

Is sending an encrypted connection string as an API Key through headers a good idea? Someone once told me, storing API Keys in a DB is a bad thing to do but I can't seem to figure out how, when in ...
2
votes
2answers
37 views

Secure authorization for subscription-based games or services

Let's suppose I'm developing a subscription-based desktop game: the player pays a fee in order to get access to certain levels of the game for a certain time. For example, the player pays $1 to get ...
1
vote
0answers
34 views

Automatic Paypal payment through API

I am building a game similar to HQ trivia, that when someone gives all the correct answers at the end of the game he or she gets money sent to their Paypal account, my concern is obviously security. ...
-1
votes
0answers
66 views

OAuth 2 Client Credentials within Mobile App

I am currently developing a mobile app that communicates with an OAuth server. The server I am trying to access provides two grants: Authorisation Code and a device PIN grant (not sure if it's part of ...
2
votes
2answers
208 views

XMLHttpRequest CSRF fails with allowed CORS

I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack. Now the following code should send a OPTIONS request, ...
0
votes
0answers
58 views

How to find accounts in leaked databases based on the domain name in the email address?

I like to find accounts in leaked databases based on the domain name associated with the leaked mail addresses. Public databases such as https://haveibeenpwned.com/ have this ability partly. Searching ...
1
vote
3answers
210 views

Is it normal for a website to show an API key in plain text that allows full access to your personal information?

I noticed some websites do this and I am not sure if this is normal or not. So for example, on some websites, I go into setting and can create an API key that will be visible in plain text. Also, ...
1
vote
1answer
97 views

Risks of building an API without authentication?

I'm planning to build an API for my project, and thinking about authentication. What is the risk of not having any authentication? Could someone 'crawl' all of my post/get routes? And how would they ...
0
votes
1answer
102 views

Signing webhooks with JWT — overkill with TLS?

I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it ...
0
votes
1answer
146 views

Is there a way to secure an API key on iOS?

When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite ...
2
votes
2answers
99 views

Sensitive data enumeration via HTTP error codes

Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user Bob a message to his cell phone which he registered on our ...
0
votes
0answers
111 views

How to secure an API key from client side?

I'm having an issue and I'm pretty sure I'm not the first on that. I'm hoping to have a few great ways, hopefully bulletproof, to avoid any issues, so here it is. I provide an API that converts HTML ...
0
votes
0answers
59 views

API isolation for multiple single page applications under the same domain

I have a case where I want to run multiple single page applications on the same domain. Those apps should get access to a specific set of APIs. Example: myapp.example/profile: hosts the profile app ...
0
votes
1answer
56 views

Secure custom API [duplicate]

I create desktop client for one e-shop and this client will use some functions using e-shop's API, like: GetOrders UpdateOrder SetOrder etc... I'm creating custom authentication for that client, but ...
4
votes
1answer
340 views

How to securely store API keys

I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a ...
0
votes
2answers
199 views

How does IP whitelisting help secure an API?

I'm trying to get a better understanding of the extent that IP whitelisting helps to prevent attacks against an API. At the moment I'm thinking of a B2B scenario where organisation A provides an API ...
1
vote
0answers
71 views

How to make sure your API key cannot just be copied and used

One thing I often struggle with when developing my API's is authentication. I didn't have much trouble with this when I was making them for just a single website and was able to implement the ...
-3
votes
1answer
469 views

How To detect Fake mobile number for SMS verification [closed]

I am facing some issues regarding SMS verification in my website. Suddenly, some transactions are happening using the fake numbers like https://www.receive-sms-online.info How to detect the number is ...
0
votes
0answers
38 views

How to pass user/pass from user to api in automated fashion

I was unsure whether to ask this on StackOverflow or here, but decided that it is more appropriate here. I'm creating a fully-automated local script that will run on a schedule. Once set up, the ...
1
vote
0answers
57 views

Security of AWS Lambda Communicating to Non-HTTPS API

Wondering what attacks might look like in the following scenario. I have a web service that pings an AWS lambda (behind API gateway), which makes a couple of transactions (sends email, adds to ...
0
votes
1answer
170 views

Vulnerability scanners for web APIs [closed]

I've built a few web APIs for my company at intellectstorm.com and I'm tasked to test these products by scanning for vulnerabilities. I can't decide on a good tool as yet; so far I've used the ...
0
votes
1answer
32 views

Enforce a secured protocol over public api

I have implemented my product's HTTP(REST) API as a public API. Although my server only allows HTTPS, I don't have any control over the clients. I have vendors implementing clients to my API, and I am ...
-1
votes
1answer
61 views

Unable to utilise curl commands on website [closed]

There is a free online SMS service called globfone which allows you to send free text messages via their website. However, I'm looking to integrate this functionality into a script through curl. But ...
3
votes
1answer
583 views

Optimal way to capture HTTP(S) traffic on proxy-unaware iOS applications

I am trying to capture HTTP(S) traffic from a proxy-unaware Xamarin iOS application. The current tools I have available is a Mac with a Linux Mint VM, Xcode and iOS developer tools, Burp Suite ...