Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

1
vote
1answer
94 views

Should I report this Google API key disclosure issue or not?

I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to: https://www.googleapis.com/customsearch/v1/...
0
votes
0answers
55 views

JSON(blob?) to POST/GET request [on hold]

First i want to say that i'm not sure if its called JSON blob, I found API endpoint on private program which i can convert from JSON to normal GET/POST request with parameters however i have found ...
0
votes
0answers
28 views

Does an OAuth1.0a HTTP GET endpoint in my API present a security vulnerability?

I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites. My application can post to Twitter on behalf of a user. This required implementing ...
4
votes
1answer
70 views

API pentesting for mobile and web. What's the difference?

So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it'...
2
votes
4answers
92 views

How to stop people from spamming the account creation url on my website [duplicate]

let's say I have a website with an account creation form. How can I stop people from writing a program that automatically submits the form thousands of times, which would fill up my database with junk ...
1
vote
0answers
25 views

Securing Rest API content using .Net Identity Framework [migrated]

Can anyone provide direction on how to add a Rest API to an existing Azure .net website as an alternative to receive private information? Like many website, we already have good U&P authentication ...
1
vote
1answer
82 views

Why is PKCE secure against man-in-the-middle attacks?

In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
1
vote
0answers
28 views

Is having multiple access tokens valid at the same time a security risk?

I run an API that allows multiple access tokens (JWT) to be valid for the same account, in order to allow users to sign into the web application and mobile app at the same time. Is this a potential ...
0
votes
0answers
42 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
1answer
37 views

Secure Exchange Rate for Restful API

I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another ...
0
votes
1answer
75 views

Subdomain api.domain.com - more vunerable to attacks?

I am in the process of setting up an api which will have the subdomain "api.", I have been advised to change this to something "less obvious" to avoid automated attacks against it. I can't find any ...
0
votes
1answer
56 views

How does using an auth server for mobile app and not storing API keys on client add security?

I've been reading about how unsafe and bad and terrible it is to store your API keys inside your mobile app (whatever solution you have for that) and that you should use a separate server for ...
1
vote
2answers
136 views

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
0
votes
2answers
117 views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere able to bypass CSRF protections? Reason to ask ...
0
votes
1answer
76 views

What are the industry guidelines on sharing secrets like API or access token?

I'm currently looking for guidelines on sharing API tokens or Access tokens securely, for integrating a third-party application with my own. The two methods I'm currently thinking of are: PGP: I ...
4
votes
4answers
293 views

Public API security: authentication vs. rate limiting etc

We are raising a SaaS product that allows businesses to setup and orchestrate selling of a certain class of goods/services. This product has an API in its core and an ecosystem of various apps around ...
0
votes
2answers
71 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
-1
votes
1answer
48 views

How do I detect spoofed REST API responses in my webapp?

I am building an internal admin panel for my team that will communicate to the backend server using a REST API. One of the API calls that will be performed will be an "authorization check" where the ...
1
vote
0answers
43 views

Are there any flaws with allowing SQL queries as part of an API to fetch data? [duplicate]

We're working on an API to allow clients access to bits of data from a series of tables. We've come up with a JSON based API which works well but it could definitely be improved upon. It has come to ...
2
votes
1answer
59 views

What's stopping attackers from using our API keys to spam our logging services?

We're logging user events using Javascript and a third-party logging service. The API key is hardcoded in JS. The logging service restricts the API key to our domain. I'm assuming it looks at the ...
0
votes
1answer
104 views

Hiding the “Allow” http header that comes with the response after an 405 API call

Hi so our security team said that we need to hide the Allow header Is the request possible?
3
votes
3answers
245 views

Encoding output in JSON HTTP API

I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, ...
2
votes
1answer
82 views

Big insurance website exposing StackTrace of Java JSON Parser

Recently I coincidentally have discovered that an api endpoint of an insurance company is sending a StackTrace of a JSON parser as response to a http POST message with bad formatted JSON in the ...
1
vote
0answers
21 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
2
votes
1answer
81 views

Unauthorized API Access Without Key Header

In order to test the security of my API, I want to act as sort of an attacker in order to try and gain access to my own API without an API key. In order for me to send requests to this endpoint, I ...
1
vote
0answers
27 views

Is it safe for a service to share memory addresses with remote clients?

Supposing a remote service has the following data structures (using C++ as an example): struct Item { std::string name; struct {} whatever_else; }; std::map <std::string, Item *> ...
5
votes
3answers
154 views

Rate Limiting An API

I am busy developing an API for a mobile application, currently one of the endpoints require that the users username and password be POST'ed to it. What I am worried about is someone discovering that ...
1
vote
1answer
103 views

AES Encryption is this overcomplicated encryption?

I'm working with a vendor's API and it recommends the following steps for transmitting an encrypted value: 1) Convert the encryption password to a byte array. 2) Convert the value to be ...
0
votes
0answers
83 views

How to properly store OAuth 2.0 client_id and client_secret in a web application?

In the PoC (Proof of Concept) that I'm currently developing, data from an API is consumed and OAuth 2.0 is required for authentication. The application is already working as expected, the users are ...
0
votes
0answers
17 views

implementing push api for files using oauth2

i want to implement a push api similar to Garmin Connect API. this api allows the clients to get the data of garmin users, as garmin will push to the clients the user's files whenever created. we ...
4
votes
1answer
85 views

How do I implement a Microsoft Login into my own website? [closed]

I am trying to make a website, which hosts a form for employees to enter their shift details into. The website itself is pretty basic, meaning it is mostly just HTML and PHP code. Obviously I need to ...
1
vote
1answer
115 views

CORS accepting arbitrary origin with GET but not with OPTIONS

I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *. However, with OPTIONS requests and an arbitrary origin, ...
2
votes
2answers
96 views

How to protect API endpoint from abuse in mobile App?

Let's assume I have a mobile app that fetches the news feed from an url on my server. GET/ https://example.com/api/v1/newsfeed Is there a way to restrict the access to this endpoint to only from ...
1
vote
1answer
1k views

Access-Control-Allow-Origin wildcard doesnt allow sending session cookies

I always thought CORS restrictions was to disable the following scenario: I enter attacker.com, JS sends GET facebook.com, my browser adds my cookies, attacker.com has access to my facebook profile/...
1
vote
1answer
47 views

Protect app from Http Proxy like Charles [duplicate]

I am using https request for web API in my app. But I know Charles allowed to access https request also, via install root certificates on device. So, someone downloaded the app from PlayStore and ...
0
votes
1answer
327 views

What all test cases/vulnerabilities we need to try in REST API Pen testing?

I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API. I have gone through the OWASP resources ...
10
votes
2answers
2k views

Public API with authorization token — is it possible to protect the demo token?

I have a REST API for running some calculations and returning the result, with a very simple token system where only authorized users can use the API. The user adds their token to the query like this:...
3
votes
1answer
86 views

Is it ok to use the same SSL certificate for both HTTPS and SOAP-level signing/encryption?

I'm currently looking after an integration platform with SOAP based web service connections out to partner organizations. At the moment, the same SSL certificate is used for both transport level ...
0
votes
3answers
209 views

Is it better to rate limit API requests based on UserId or IP address for authenticated users?

I'm thinking of rate limiting anonymous requests based on IP, but for users with a valid authentication token, I can't decide if it's better to log and rate limit requests based on their UserId or IP ...
1
vote
0answers
30 views

Nested API security

What are best practices for securing nested APIs? Here is an example: User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet) Typically,...
1
vote
1answer
29 views

What methods can I use to prevent a public API's limit bypass?

So let's say that after 50 requests in a period of 30 seconds, a user's IP gets blacklisted. They can still bypass this block by changing their IP, which is quite easy and fast nowadays. So, what ...
1
vote
0answers
187 views

How to bypass a public API's usage limit block? [closed]

I'm trying to build a database with information that I can get with a lot of http GET requests to the target server's API. The problem is that they obviously do have restrictions. After 80+ requests,...
1
vote
3answers
84 views

Why allow a public API Key to change?

A common method of credentialing for an API is to give each use a public/private key pair. The public key is sent in with the request, and the private key is used to sign the request (and is verified ...
2
votes
2answers
212 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...
1
vote
0answers
26 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
2
votes
0answers
88 views

Disable Google API key without access to google account

I was trying the new google api - I created anonymous account - added there my debit card, set up the API key for google maps. Tried API and pushed my API key to shared repository (yes I know - my ...
9
votes
3answers
432 views

I don't understand what's wrong with just using cookies for authentication?

I'm writing an app-server and there is an option to just use secure cookies for authentication. Here's how it seems to work: You define a 32-byte secret key on the server When the user logs in, you ...
2
votes
1answer
120 views

Is OAuth appropriate for a private API to be used by registered customers?

I am developing a private API that will be used by pre-registered clients to access information on our website. We will be storing their login credentials on our server. When looking into how to ...
2
votes
1answer
165 views

Allowing unauthenticated user access web page information

Our web application should allow unregistered users to browse certain information. This information is returned by apis Currently we are using hardcoded guest login to achieve this The mere ...
3
votes
1answer
150 views

API Key in microservices

Is sending an encrypted connection string as an API Key through headers a good idea? Someone once told me, storing API Keys in a DB is a bad thing to do but I can't seem to figure out how, when in ...