A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Filter by
Sorted by
Tagged with
0
votes
1answer
38 views

Secure error messages from public API

We are writing our first public API. Now I remember hearing in the past that you shouldn't give users useful error messages, that allows hackers to learn what your data is. so if the get is { ...
0
votes
1answer
87 views

Unnecessary SSL encryption in API?

Im developing my first API but I think I can optimize the server response by eliminating an SSL decryption. The server recieves POST request with two parameters: Action (int value) Data (base 64 ...
-1
votes
0answers
24 views

Security headers for aplication which uses JWT, WebSockets and API

I am testing web application which uses JWT, WebSockets and API. In Burp Proxy – HTTP history I can see only JSON, TXT or empty responses like 200 OK after adding content etc and only one HTTP ...
0
votes
0answers
41 views

How come RFC7636 (PKCE) stops malicous app doing the same code challenge and get legitimate access to API

As per the RFC7636 it stops malicious apps which pretend to be legitimate apps, gaining access to OAuth2.0 protected API's. The flow suggests a method of having a runtime level secret which generated ...
0
votes
0answers
34 views

Preventing jwt replay attacks against the client-side

first of all thank you for reading my question. I already read good answers about preventing replay attacks with JWT and a lot of resources like jwt.io. The conclusion was that I needed to use the ...
0
votes
0answers
52 views

Reusing Bearer Tokens in Test System

We are integrating into a system and I have some concerns over the security. As a test, I have taken a bearer token that was issued in a request 2 months ago and managed to perform a successful, ...
1
vote
0answers
33 views

How to handle application/jsonp response

I am testing a Web Application and i have found a endpoint which is returning some data in json the endpoint is this. /api/vtexid/pub/authenticated/user Now i was testing to find out that if this ...
1
vote
1answer
64 views

Protect public(?) API endpoints

I'm building a fairly simple web application at the moment but because I have plans on turning this into sort of a multi-project portfolio app, I've decided to decouple the back-end and the front-end. ...
2
votes
1answer
112 views

What is the point of the payload in reset password API with JWT

I am trying to write an API that allows the user to reset their password via their email. I have been following https://www.smashingmagazine.com/2017/11/safe-password-resets-with-json-web-tokens/, ...
1
vote
1answer
73 views

Storing third party API tokens in a database

Currently I have a Node JS project that uses the Spotify API. The project displays the users top played artists and tracks. I am following the Authorization Code Flow to obtain the access token. This ...
3
votes
2answers
162 views

How to store API keys when algo trading?

I write Python scripts for clients to "algo trade" at currency/stock exchange websites. My clients are typically running my scripts on traditional personal desktop PC's. Usually using these PCs for ...
1
vote
0answers
61 views

Is it possible to get hacked by a redirection placed inside a Facebook Graph URL?

Basically, I have a webapp which needs to check the validity of the user of an Android app. After completing the basic login flow with Facebook in the Android app, a Facebook access token is sent to ...
1
vote
1answer
81 views

Should one not give path parameters in rest urls to avoid man in the middle attacks?

Recently I attended a workshop were the presenter explained securing rest APIs. One of the things he recommended to avoid man in the middle attacks was to not send IDs in the URLs (i.e. not sending ...
2
votes
2answers
78 views

Is putting an authentication tokens inside the HTML body safe?

I have a project, a webapp/website that uses cookies to authenticate users with long randomly generated strings (also with samesite:lax, httponly, secure), however I also have an API which itself ...
2
votes
2answers
114 views

Hawk vs. API key authentication

For a HTTP(S) API, which is better (/ which is better under which circumstances)? Hawk authentication (a secret key is used to create a signature which is transmitted with the request: similar to AWS ...
4
votes
0answers
44 views

What was the original intent for the feature that StrandHogg uses?

The "Affinity" of Android tasks seems really complex to handle. The StrandHogg vulnerability uses tricks with "Affinity" to render itself inside an another app. The information that I've found this ...
1
vote
1answer
54 views

What are the security risks of basic authorization in SOAP requests?

What are the security risks of basic authorization in SOAP requests? I know that the username and password are concatenated and sent in Base64 in an HTTP header on every subsequent request, but it is ...
1
vote
0answers
59 views

API protection - JWT vs HMAC signing vs OAuth

Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers. ...
4
votes
1answer
50 views

Do websites grant their own JWT token after successful OpenID/OAuth2 login?

I am looking at implementing an Authorization Code with PKCE grant on a mobile app to communicate to an API. What I am curious about is what applications currently do with the OpenID token that is ...
1
vote
1answer
71 views

Securing API access. oAuth Client Credentials vs client ID and secret

I have a REST API that will be called by other external 3rd party servers over the internet and be used only for machine to machine communication. I am looking for mechanisms to secure this API such ...
3
votes
1answer
59 views

What are the security implications of allowing API consumer to decide primary key stored in database?

Story We are developing an API that which allow consumer to create or modify (i.e. upsert) objects stored in database via an endpoint with HTTP PUT. The primary key of the object stored in this way ...
1
vote
1answer
46 views

What is the way to know that the endpoint is down if there is an L4 / L7 balancer?

I'm writing an API-fuzzer and I want to detect if a sequence cause falling down of an endpoint of some service. Of course I can get 500 response code, but it's may be called from code of an endpoint. ...
1
vote
1answer
63 views

How to protect against injection into a 3rd party REST API?

I have a 3rd party API that I need to connect to and they allow queries that can be formed by changing url parameters. E.g. /data?startDate=2019-01-01 or /data?name='John Doe' It is easy to form ...
3
votes
1answer
135 views

Are GUIDs safe for long lived access tokens?

There is a peice of software i am using at work that has several components to it, lets call them the server and agents. the server runs an api over https that the agents use to communicate with it. ...
0
votes
0answers
61 views

What is the difference between using an auth header and the request body to send credentials?

I have an API that uses JWT token-based authentication. In order to get a short-lived token, the client first calls a /Token endpoint, passing username and password in the body of the request. As I ...
4
votes
1answer
103 views

Is it possible to change an API response using the host file?

Would it be possible for someone to hijack the response of an API by using the host file, so for example www.sitename.com calls api.sitename.com/api/products. Could I use the host file to redirect the ...
6
votes
1answer
115 views

GET request in the body of GET request

I'm testing some API endpoints aaand with some arbitrary crazy tests, like: GET /products/items HTTP/1.1 Host: api.companysite.com Content-Type: application/xml User-Agent: Mozilla/5.0 (Windows NT 5....
2
votes
1answer
110 views

Is adding a prefix to an API token lowering it's security

When creating API tokens, one can pick any format one likes. Many people choose to use 40 random characters. I'm wondering how much of a security issue is to prefix the API key with a prefix "...
0
votes
0answers
108 views

Configure gRPC with Burp Suite

I have been given a task to do security auditing of the APIs which are running in gRPC. I am using BloomRPC for querying the gRPC Services. But there so no such option in BloomRPC to proxy the ...
0
votes
2answers
54 views

Scraping data from a form submission on another domain

I’m currently researching a possible security vulnerability I may have found on a well-known website. Before I present to the company, I’d like to build a proof of concept. I’m looking at a site (...
1
vote
0answers
43 views

Integrating web applications into our payment API. How to ensure the integrity of the payment process?

We will be creating a brand new application soon that handles online payments for our firm. We now have several different web applications (in different technologies) running that will all be ...
1
vote
0answers
66 views

Security aspect in the API gateway area

I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level. Scanning REST APIs (see http://docs.w3af....
1
vote
2answers
81 views

Secure API key mechanism for identification

In my web application, when the user logs in, a pair of JWT(JSON web tokens),access token and refresh token is sent with some fixed time validity. Using access token client is authenticated and using ...
0
votes
0answers
19 views

Secure API and User Data both with Oauth2.0

We are currently looking at adding API endpoints for a third party to consume and the endpoints will be concerning individual user data. The current proposed security architecture is to use Oauth2.0 ...
0
votes
0answers
26 views

Can I rely on Google id_token for web session?

I'm building a website without a "server": JavaScript and AWS Lambdas as back-end through API Gateway. Knowing there is no solution for session when using lambdas, I was wondering if I could only use ...
1
vote
1answer
124 views

Is it a major security risk if your client_secret gets displayed for about 30 min - 1 hour before you notice it showing and you can remove it? [duplicate]

Did something stupid, and asked a question on stackoverflow posted a little too much info without realizing it. Is it a major security risk if your client_secret gets displayed for about 30 min - 1 ...
0
votes
0answers
67 views

nonce encryption in https

I am thinking about using nonce and secure request to API Server. Is this the right implementation for using nonce? PURPOSE Protect API Server from Replay attack Protect API Server from MITM attack ...
0
votes
2answers
657 views

Rest API Sensitive Data GET

We are trying to decide the best approach to designing our new interface with our consumers. Currently we are talking about an Rest API. However there is some debate among our team about how to ...
0
votes
1answer
58 views

SSL certificate distribution of API

We have an API which has SSL certificate signed from authorized CA. The access to the API is limited. API is accessed from webapp and only from those client who have valid public key for SSL. Now, how ...
1
vote
1answer
82 views

Security and the Definition of Ready and Done [closed]

Currently I am in a project where I have to test REST APIs among other things. In another question of mine I also discussed the topics Definition of Ready and Definition of Done regarding security. ...
0
votes
2answers
122 views

Rest API Security Guideline. Developer Rules? [closed]

In my current project I am also setting up the area of security testing. So far there was no way to use security within the REST API development. Beside the known approach, e.g. using static software ...
5
votes
4answers
494 views

Generate API keys with JWT and regenerate the same key when needed

I recently found my self in need of developing a public API for my application. I developed my application with node.js and MongoDB. After some research, I decided to use jwt for generating API keys ...
5
votes
4answers
109 views

Security considerations of consuming public API

I have a website and i want to consume public API from third party services such as Zoopla, weather etc. I want to ensure i do not consume malicious code/malware from the data retrieved from the 3rd ...
0
votes
0answers
72 views

Should I hash responses from server?

I am hashing all requests to my server with a secret token known by only the server and my mobile app to prevent malicious apps from using my servers. Should I also do this on the responses from the ...
1
vote
0answers
50 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
2
votes
1answer
167 views

How to securely share sensitive info (such as API keys) with freelancers?

My business partner and I are building a webapplication. We have partnered with some third party services which make use of API (public and secret) keys. The freelance developer we worked with ...
1
vote
1answer
49 views

How to secure embedded code containing REST api call

I am making a Google Analytics like service where you embed generated code into your website and it tracks certain data. I have a backend REST api, but I am not sure how to securely implement a call ...
0
votes
0answers
36 views

Public report/telemetry API

I want to implement a telemetry data sender into my electron app. The API which I want to connect to is public. So any crash reports or any other data from the user is sent to it. The problem is how ...
0
votes
0answers
17 views

Server to Server API Security [duplicate]

Background I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote ...
0
votes
0answers
54 views

How does Google restrict API access by mobile App ID?

Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers. How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...