Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

0
votes
1answer
39 views

How does using an auth server for mobile app and not storing API keys on client add security?

I've been reading about how unsafe and bad and terrible it is to store your API keys inside your mobile app (whatever solution you have for that) and that you should use a separate server for ...
0
votes
0answers
32 views
+50

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
0
votes
0answers
37 views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere able to bypass CSRF protections? Reason to ask ...
0
votes
1answer
75 views

What are the industry guidelines on sharing secrets like API or access token?

I'm currently looking for guidelines on sharing API tokens or Access tokens securely, for integrating a third-party application with my own. The two methods I'm currently thinking of are: PGP: I ...
0
votes
0answers
21 views

Establish a secure communication between third-party Javascript Client and REST API [on hold]

There's a third-party company that is developing something like an script tag that could be included in any Web page in order to start interaction with a chat. They are trying to do something like ...
4
votes
4answers
272 views

Public API security: authentication vs. rate limiting etc

We are raising a SaaS product that allows businesses to setup and orchestrate selling of a certain class of goods/services. This product has an API in its core and an ecosystem of various apps around ...
0
votes
2answers
53 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
-1
votes
1answer
47 views

How do I detect spoofed REST API responses in my webapp?

I am building an internal admin panel for my team that will communicate to the backend server using a REST API. One of the API calls that will be performed will be an "authorization check" where the ...
1
vote
0answers
42 views

Are there any flaws with allowing SQL queries as part of an API to fetch data? [duplicate]

We're working on an API to allow clients access to bits of data from a series of tables. We've come up with a JSON based API which works well but it could definitely be improved upon. It has come to ...
2
votes
1answer
57 views

What's stopping attackers from using our API keys to spam our logging services?

We're logging user events using Javascript and a third-party logging service. The API key is hardcoded in JS. The logging service restricts the API key to our domain. I'm assuming it looks at the ...
0
votes
1answer
56 views

Hiding the “Allow” http header that comes with the response after an 405 API call

Hi so our security team said that we need to hide the Allow header Is the request possible?
3
votes
3answers
123 views

Encoding output in JSON HTTP API

I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, ...
2
votes
1answer
80 views

Big insurance website exposing StackTrace of Java JSON Parser

Recently I coincidentally have discovered that an api endpoint of an insurance company is sending a StackTrace of a JSON parser as response to a http POST message with bad formatted JSON in the ...
1
vote
0answers
18 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
2
votes
1answer
77 views

Unauthorized API Access Without Key Header

In order to test the security of my API, I want to act as sort of an attacker in order to try and gain access to my own API without an API key. In order for me to send requests to this endpoint, I ...
1
vote
0answers
27 views

Is it safe for a service to share memory addresses with remote clients?

Supposing a remote service has the following data structures (using C++ as an example): struct Item { std::string name; struct {} whatever_else; }; std::map <std::string, Item *> ...
5
votes
3answers
154 views

Rate Limiting An API

I am busy developing an API for a mobile application, currently one of the endpoints require that the users username and password be POST'ed to it. What I am worried about is someone discovering that ...
1
vote
1answer
101 views

AES Encryption is this overcomplicated encryption?

I'm working with a vendor's API and it recommends the following steps for transmitting an encrypted value: 1) Convert the encryption password to a byte array. 2) Convert the value to be ...
0
votes
0answers
56 views

How to properly store OAuth 2.0 client_id and client_secret in a web application?

In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
0
votes
0answers
17 views

implementing push api for files using oauth2

i want to implement a push api similar to Garmin Connect API. this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created. we ...
4
votes
1answer
85 views

How do I implement a Microsoft Login into my own website? [closed]

I am trying to make a website, which hosts a form for employees to enter their shift details into. The website itself is pretty basic, meaning it is mostly just HTML and PHP code. Obviously I need to ...
1
vote
1answer
79 views

CORS accepting arbitrary origin with GET but not with OPTIONS

I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *. However, with OPTIONS requests and an arbitrary origin, ...
2
votes
2answers
93 views

How to protect API endpoint from abuse in mobile App?

Let's assume I have a mobile app that fetches the news feed from an url on my server. GET/ https://example.com/api/v1/newsfeed Is there a way to restrict the access to this endpoint to only from ...
1
vote
1answer
846 views

Access-Control-Allow-Origin wildcard doesnt allow sending session cookies

I always thought CORS restrictions was to disable the following scenario: I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/...
1
vote
1answer
45 views

Protect app from Http Proxy like Charles [duplicate]

I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
0
votes
1answer
226 views

What all test cases/vulnerabilities we need to try in REST API Pen testing?

I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API. I have gone through the OWASP resources ...
10
votes
2answers
2k views

Public API with authorization token — is it possible to protect the demo token?

I have a REST API for running some calculations and returning the result, with a very simple token system where only authorized users can use the API. The user adds their token to the query like this:...
2
votes
1answer
68 views

Is it ok to use the same SSL certificate for both HTTPS and SOAP-level signing/encryption?

I'm currently looking after an integration platform with SOAP based web service connections out to partner organizations. At the moment, the same SSL certificate is used for both transport level ...
0
votes
3answers
141 views

Is it better to rate limit API requests based on UserId or IP address for authenticated users?

I'm thinking of rate limiting anonymous requests based on IP, but for users with a valid authentication token, I can't decide if it's better to log and rate limit requests based on their UserId or IP ...
1
vote
0answers
28 views

Nested API security

What are best practices for securing nested APIs? Here is an example: User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet) Typically,...
1
vote
1answer
29 views

What methods can I use to prevent a public API's limit bypass?

So let's say that after 50 requests in a period of 30 seconds, a user's IP gets blacklisted. They can still bypass this block by changing their IP, which is quite easy and fast nowadays. So, what ...
1
vote
0answers
149 views

How to bypass a public API's usage limit block? [closed]

I'm trying to build a database with information that I can get with a lot of http GET requests to the target server's API. The problem is that they obviously do have restrictions. After 80+ requests,...
1
vote
3answers
79 views

Why allow a public API Key to change?

A common method of credentialing for an API is to give each use a public/private key pair. The public key is sent in with the request, and the private key is used to sign the request (and is verified ...
2
votes
1answer
174 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...
1
vote
0answers
24 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
2
votes
0answers
83 views

Disable Google API key without access to google account

I was trying the new google api - I created anonymous account - added there my debit card, set up the API key for google maps. Tried API and pushed my API key to shared repository (yes I know - my ...
9
votes
3answers
396 views

I don't understand what's wrong with just using cookies for authentication?

I'm writing an app-server and there is an option to just use secure cookies for authentication. Here's how it seems to work: You define a 32-byte secret key on the server When the user logs in, you ...
2
votes
1answer
114 views

Is OAuth appropriate for a private API to be used by registered customers?

I am developing a private API that will be used by pre-registered clients to access information on our website. We will be storing their login credentials on our server. When looking into how to ...
2
votes
1answer
132 views

Allowing unauthenticated user access web page information

Our web application should allow unregistered users to browse certain information. This information is returned by apis Currently we are using hardcoded guest login to achieve this The mere ...
2
votes
1answer
123 views

API Key in microservices

Is sending an encrypted connection string as an API Key through headers a good idea? Someone once told me, storing API Keys in a DB is a bad thing to do but I can't seem to figure out how, when in ...
2
votes
2answers
40 views

Secure authorization for subscription-based games or services

Let's suppose I'm developing a subscription-based desktop game: the player pays a fee in order to get access to certain levels of the game for a certain time. For example, the player pays $1 to get ...
1
vote
0answers
36 views

Automatic Paypal payment through API

I am building a game similar to HQ trivia, that when someone gives all the correct answers at the end of the game he or she gets money sent to their Paypal account, my concern is obviously security. ...
2
votes
2answers
513 views

XMLHttpRequest CSRF fails with allowed CORS

I'm currently working on a PoC for a CSRF attack, which should be possible due to the lax CORS configuration. I have a permission to attack. Now the following code should send a OPTIONS request, ...
0
votes
0answers
86 views

How to find accounts in leaked databases based on the domain name in the email address?

I like to find accounts in leaked databases based on the domain name associated with the leaked mail addresses. Public databases such as https://haveibeenpwned.com/ have this ability partly. Searching ...
1
vote
3answers
363 views

Is it normal for a website to show an API key in plain text that allows full access to your personal information?

I noticed some websites do this and I am not sure if this is normal or not. So for example, on some websites, I go into setting and can create an API key that will be visible in plain text. Also, ...
1
vote
1answer
136 views

Risks of building an API without authentication?

I'm planning to build an API for my project, and thinking about authentication. What is the risk of not having any authentication? Could someone 'crawl' all of my post/get routes? And how would they ...
0
votes
1answer
155 views

Signing webhooks with JWT — overkill with TLS?

I have a server that sends webhook notifications to client servers. Before the client server begins processing anything, it should be certain that the webhook originated from my server, and that it ...
0
votes
1answer
302 views

Is there a way to secure an API key on iOS?

When a user logs in the App, they are given a unique API key (each user's API key will be different). The user uses this API key to make HTTP requests. Currently, the API key is saved in an SQLite ...
2
votes
2answers
106 views

Sensitive data enumeration via HTTP error codes

Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user Bob a message to his cell phone which he registered on our ...
1
vote
0answers
212 views

How to secure an API key from client side?

I'm having an issue and I'm pretty sure I'm not the first on that. I'm hoping to have a few great ways, hopefully bulletproof, to avoid any issues, so here it is. I provide an API that converts HTML ...