Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Filter by
Sorted by
Tagged with
16
votes
7answers
4k views

Protect API from being tampered?

I'm building an API with websocket that serializes data through JSON. The App itself is a chat application. I came up with the following structure to send my data: {date: '2020-05-31', time: '14:28:...
0
votes
0answers
42 views

Can a .pfx certificate file be shared between machines?

To access an API developed by a co-worker, he needed to whitelist my IP address and give me a certificate, which came in with the .pfx extension. I can access the API front-end just fine, but I cannot ...
0
votes
0answers
33 views

Restricting website usage for Google Maps API doesn't prevent it from being used in the browser?

Say I've restricted my Google Maps API key to the website example.com/*. This would mean that no other website domains could use my API key to make requests to maps.googleapis.com. However, using the ...
0
votes
2answers
50 views

How can API documentation helpful to exploit any application?

Here I want to understand what if private API Documentation is exposed how can a hacker exploited the application as all the endpoints have authorization & authentication. its is really going to ...
0
votes
0answers
37 views

Can we keep Pusher API keys public?

I was looking at my company site and I saw Pusher API keys are exposed. Should it be kept public?
0
votes
1answer
62 views

Database breach protection [duplicate]

I'm developing an API which requires an API key to use. These keys are assigned to users. To figure out which user the key belongs to, I have to store some information in that key. But I don't want it ...
1
vote
1answer
37 views

Access-Control-Allow-Origin and security behind it [duplicate]

I have some troubles to understand how the header "Access-Control-Allow-Origin" can really be secure. Let me explain what I have in mind: Let's say I have an API on api.contoso.com setting this ...
0
votes
1answer
43 views

Is there a current best practice for authorizing an SPA to get/post to API

I have an API and an SPA. The SPA is all anonymous but I want to ensure the caller of the API is authorized to do so. It seems that all of the OAuth best practices, e.g. PKCE, depend on a user ...
2
votes
1answer
77 views

Should we use API keys for authorization on a public API (instead of JWT)?

We are building a public-facing API. The consumers of this API will be business partners of ours - we will probably have a personal relationship with each one, and I suspect there will only ever be 10-...
2
votes
1answer
75 views

How does Algolia's virtual API keys work?

Algolia allows you to generate virtual/secured API keys from another parent API key but without a call to their servers. A virtual key thus generated on the server side with a defined "scope" (like ...
136
votes
24answers
19k views

Why can't I just let customers connect directly to my database?

I'm pretty sure this is a stupid idea but I'd like to know why, so bear with me for a moment. Lots of the work backend developers do is providing CRUD access to customers via HTTP, essentially mapping ...
0
votes
0answers
37 views

A mesh of Cookie in Header & HttpOnly token - secure “enough”?

This is another attempt of mine to make sense of securing my web-app, which is built with two frameworks: Django REST API - serves as the backend. It generates both a token upon correct login, and a ...
2
votes
1answer
91 views

API request signing best practices

I am reading how different services are handling API signature and authentication. Particularly I was looking at: AWS Signing v4 WeChat Signature Algorithm Alipay Digital Signature Google Maps API I ...
1
vote
0answers
32 views

Generate new AccessToken each time user update his Information

im building a PWA app , where i implemented jwt token to auth users. i have 2 main architecture problems ,but let me introduce you what im building . i'm Building application that is all about dog ...
-1
votes
1answer
35 views

owasp zap api with generate param [closed]

my api is: localhost/api/aut/1111111111111111 I wanted a script that generate a code of 16 numeric and test possibility the result 200 or 404
0
votes
0answers
34 views

Do you need TLS when using WS-Security?

I'm looking into implementation of SOAP API's and understanding the security of these when using utilizing them on internet facing endpoints. Regarding the security of data sent to these API's, from ...
1
vote
2answers
100 views

Validating XSS Vulnerability in Rest API

I am performing security testing on a Rest API and it is a POST method. I injected a XSS script in a body parameter and the API responded with '400 Bad Request' error, but the response displays the ...
0
votes
1answer
92 views

OAuth2 - Sending a hash of your client_secret when using the client credentials grant instead of the secret

I'm working on an API that I'd like to be accessible internally by other servers as well as devices that I consider both as confidential private clients. Devices are considered private clients because ...
0
votes
0answers
59 views

How to secure API used by third-parties?

What I am building is service that can be consumed by third-party. Something like Omdb API for example. For my service to be functional I needed to disable CSRF on some endpoints. How can I secure ...
0
votes
0answers
34 views

How Do Online Identiy Verification Companies Ensures Their APIs to Be Not Abused?

I am trying to implement a photo ID verification along with a live-selfie verification on my Android/iOS apps. I figured that I might be able to implement these features using Python machine learning ...
3
votes
1answer
110 views

How to secure REST API for parameter manipulation?

I am developing secure payment APIs, i want to avoid manipulation of API parameters and fired same API again. For example, following is the API call https://api.payment.com/wallet/transfer?...
0
votes
1answer
57 views

Authentication for server to server api

I want to design an api which an organization is going to use to connect with my server. For a client-server application, a simple jwt-based authentication is done by verifying user credential and ...
2
votes
3answers
387 views

Is it possible to extract a certificate that an application uses to connect to an API server?

There's an API server that only allows connections including specific SSL certificates. Talking about an Android application that has those certificates. Using Fiddler without SSL decryption as a ...
0
votes
0answers
36 views

API security multi step vulnerabilities

Anyone know of a good fast way to detect multi step vulnerabilities? For example x endpoint is a dumb post and returns success. Y endpoint gets the request that was submitted in x.
0
votes
1answer
83 views

API Key via Basic Auth: Send it as a username or as a password?

In APIs that authenticates with a single API key (eg a long random string) via Basic Auth, I have seen that most (eg Stripe, Unbounce) sends the API key as the username, leaving the password field ...
0
votes
0answers
35 views

JWT in GraphQL GET Request via AJAX

I have a SPA (Single Page Application) that receives and updates information about the logged in user from the API using an AJAX request. However, the requests are authorized using a JWT (JSON Web ...
0
votes
0answers
52 views

What is the recommended way to generate API tokens using Laravel framework?

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
0
votes
0answers
34 views

I found io.fabric.apikey in Androidmanifest.xml [duplicate]

Is there any way to use this api maliciously. If yes please give reference. If this api key is leaking anywhere on internet is it considered as sensitive?
1
vote
1answer
57 views

I am signing (HMAC) outgoing webhooks to allow users to verify their source, should I also sign outgoing responses?

To allow api users to verify the authenticity of outgoing webhooks, I am using a similar model to slack: Concatenate timestamp and body, HMAC with pre-shared key, add timestamp and HMAC digest to ...
1
vote
1answer
67 views

Securing an API for 3rd party users

I'm having issues finding the right language to search for answers to my problem so hopefully I can explain it here. I am trying to create an API that will be accessed by a 3rd party. This 3rd party ...
0
votes
1answer
62 views

Secure error messages from public API

We are writing our first public API. Now I remember hearing in the past that you shouldn't give users useful error messages, that allows hackers to learn what your data is. so if the get is { ...
0
votes
1answer
108 views

Unnecessary SSL encryption in API?

Im developing my first API but I think I can optimize the server response by eliminating an SSL decryption. The server recieves POST request with two parameters: Action (int value) Data (base 64 ...
0
votes
0answers
42 views

How come RFC7636 (PKCE) stops malicous app doing the same code challenge and get legitimate access to API

As per the RFC7636 it stops malicious apps which pretend to be legitimate apps, gaining access to OAuth2.0 protected API's. The flow suggests a method of having a runtime level secret which generated ...
1
vote
1answer
92 views

Preventing jwt replay attacks against the client-side

I already read good answers about preventing replay attacks with JWT and a lot of resources like jwt.io. The conclusion was that I needed to use the jti claim. From: Can I prevent a replay attack of ...
1
vote
0answers
55 views

How to handle application/jsonp response

I am testing a Web Application and i have found a endpoint which is returning some data in json the endpoint is this. /api/vtexid/pub/authenticated/user Now i was testing to find out that if this ...
1
vote
1answer
208 views

Protect public(?) API endpoints

I'm building a fairly simple web application at the moment but because I have plans on turning this into sort of a multi-project portfolio app, I've decided to decouple the back-end and the front-end. ...
2
votes
1answer
136 views

What is the point of the payload in reset password API with JWT

I am trying to write an API that allows the user to reset their password via their email. I have been following https://www.smashingmagazine.com/2017/11/safe-password-resets-with-json-web-tokens/, ...
1
vote
1answer
232 views

Storing third party API tokens in a database

Currently I have a Node JS project that uses the Spotify API. The project displays the users top played artists and tracks. I am following the Authorization Code Flow to obtain the access token. This ...
3
votes
2answers
603 views

How to store API keys when algo trading?

I write Python scripts for clients to "algo trade" at currency/stock exchange websites. My clients are typically running my scripts on traditional personal desktop PC's. Usually using these PCs for ...
1
vote
0answers
72 views

Is it possible to get hacked by a redirection placed inside a Facebook Graph URL?

Basically, I have a webapp which needs to check the validity of the user of an Android app. After completing the basic login flow with Facebook in the Android app, a Facebook access token is sent to ...
1
vote
1answer
86 views

Should one not give path parameters in rest urls to avoid man in the middle attacks?

Recently I attended a workshop were the presenter explained securing rest APIs. One of the things he recommended to avoid man in the middle attacks was to not send IDs in the URLs (i.e. not sending ...
2
votes
2answers
82 views

Is putting an authentication tokens inside the HTML body safe?

I have a project, a webapp/website that uses cookies to authenticate users with long randomly generated strings (also with samesite:lax, httponly, secure), however I also have an API which itself ...
2
votes
2answers
144 views

Hawk vs. API key authentication

For a HTTP(S) API, which is better (/ which is better under which circumstances)? Hawk authentication (a secret key is used to create a signature which is transmitted with the request: similar to AWS ...
16
votes
1answer
217 views

What was the original intent for the feature that StrandHogg uses?

The "Affinity" of Android tasks seems really complex to handle. The StrandHogg vulnerability uses tricks with "Affinity" to render itself inside an another app. The information that I've found this ...
1
vote
1answer
73 views

What are the security risks of basic authorization in SOAP requests?

What are the security risks of basic authorization in SOAP requests? I know that the username and password are concatenated and sent in Base64 in an HTTP header on every subsequent request, but it is ...
1
vote
0answers
94 views

API protection - JWT vs HMAC signing vs OAuth

Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers. ...
4
votes
1answer
50 views

Do websites grant their own JWT token after successful OpenID/OAuth2 login?

I am looking at implementing an Authorization Code with PKCE grant on a mobile app to communicate to an API. What I am curious about is what applications currently do with the OpenID token that is ...
2
votes
1answer
203 views

Securing API access. oAuth Client Credentials vs client ID and secret

I have a REST API that will be called by other external 3rd party servers over the internet and be used only for machine to machine communication. I am looking for mechanisms to secure this API such ...
3
votes
1answer
63 views

What are the security implications of allowing API consumer to decide primary key stored in database?

Story We are developing an API that which allow consumer to create or modify (i.e. upsert) objects stored in database via an endpoint with HTTP PUT. The primary key of the object stored in this way ...
1
vote
1answer
51 views

What is the way to know that the endpoint is down if there is an L4 / L7 balancer?

I'm writing an API-fuzzer and I want to detect if a sequence cause falling down of an endpoint of some service. Of course I can get 500 response code, but it's may be called from code of an endpoint. ...

1
2 3 4 5
8