Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Filter by
Sorted by
Tagged with
0
votes
2answers
1k views

How does IP whitelisting help secure an API?

I'm trying to get a better understanding of the extent that IP whitelisting helps to prevent attacks against an API. At the moment I'm thinking of a B2B scenario where organisation A provides an API ...
-3
votes
1answer
736 views

How To detect Fake mobile number for SMS verification [closed]

I am facing some issues regarding SMS verification in my website. Suddenly, some transactions are happening using the fake numbers like https://www.receive-sms-online.info How to detect the number is ...
2
votes
0answers
86 views

How to make sure your API key cannot just be copied and used

One thing I often struggle with when developing my API's is authentication. I didn't have much trouble with this when I was making them for just a single website and was able to implement the ...
8
votes
3answers
317 views

Reason to use only secrets as API keys?

Many APIs protected with API keys only use the secret key (i.e. a password) without something like an account ID or username. For example Stripe API uses the secret key as the username in Basic Auth, ...
1
vote
0answers
91 views

Security of AWS Lambda Communicating to Non-HTTPS API

Wondering what attacks might look like in the following scenario. I have a web service that pings an AWS lambda (behind API gateway), which makes a couple of transactions (sends email, adds to ...
0
votes
1answer
337 views

Vulnerability scanners for web APIs [closed]

I've built a few web APIs for my company at intellectstorm.com and I'm tasked to test these products by scanning for vulnerabilities. I can't decide on a good tool as yet; so far I've used the ...
2
votes
1answer
453 views

Generating request-specific token for an API

We have an API openly accessible through a data visualization on a website and an app. We'd like to make the life of potential data scrapers a bit more difficult. First thing we did was to add some ...
1
vote
1answer
421 views

IAT Hooking questions?

I have researched IAT hooking by malware and i still have a few questions: If the IAT of the program in memory is different to the IAT of the static program (before it has been ran) does this imply a ...
-1
votes
1answer
113 views

Unable to utilise curl commands on website [closed]

There is a free online SMS service called globfone which allows you to send free text messages via their website. However, I'm looking to integrate this functionality into a script through curl. But ...
3
votes
1answer
1k views

Optimal way to capture HTTP(S) traffic on proxy-unaware iOS applications

I am trying to capture HTTP(S) traffic from a proxy-unaware Xamarin iOS application. The current tools I have available is a Mac with a Linux Mint VM, Xcode and iOS developer tools, Burp Suite ...
1
vote
2answers
134 views

Are HTTP calls from hundreds of ips in the same subnet malicious?

I've been getting hit everyday with 50-100M calls to my API and I'm trying to identify the subnets that are the sources. I found by running a match in redis (where all requests from the last 24hrs ...
1
vote
1answer
520 views

Hash a secret API key with a random salt instead of sending sending it alone in REST API

Say, I have an internal https API endpoint used only by me being the admin. In each each request I send a secret API key for authentication. And I'm fine with this solution. curl -x PUT ....... -...
2
votes
0answers
45 views

Issuing Personal Access Tokens for my APIs

I have an intranet site, hosted locally within my organisation. The same site also exposes some data through various web services. It's written using ASP.NET MVC 5 and WebAPI 2. At the moment users ...
5
votes
1answer
124 views

Does returning a 401 error from an API leak information?

I'm developing an API for an application I'm working on and I've come across an interesting question: Imagine an API endpoint like this: GET /customers/123456 which returns a single customer object....
5
votes
1answer
645 views

Why some applications host the API in a different domain?

I have seen a trend of applications moving their APIs to other domains (from api.application.com to api.applicationapi.com). Two examples: 3.basecampapi.com and api.dropboxapi.com Is there a ...
2
votes
1answer
2k views

A simplistic stateless alternative to HTTP basic auth for API's

Many API's (services) today use OAuth, HTTP Basic Authentication or API keys to authenticate their users. My goal is to find a simplistic secure way to authenticate users in a client-side ...
0
votes
1answer
157 views

Best practice to share google drive API credentials for being used by a script?

In a nutshell: Shall I share oauth2-credentials in our source code with the scope of full write-access to a google drive from a dedicated single-purpose google-account? so, I've written a python ...
1
vote
0answers
273 views

Sending a POST request with directory traversal attack

I'm trying to fuzz an embedded web server. The problem is that the API requests require a user be logged in by sending a POST request with the username and password. Without the POST request the ...
2
votes
1answer
3k views

Secure REST API without a user registration

I have an API in Node JS with mostly GET endpoints and a client side single page application. The application is meant to be open without the need to authenticate, i.e like booking.com where you can ...
1
vote
1answer
482 views

Security in unofficial telegram apps(that use Telegram API)

I was wondering that can developers of an unofficial Telegram apps gain access to media and files that users send over the app? (Unofficial Telegrams use the Telegram API and connect to Telegram ...
2
votes
2answers
307 views

Security on a REST Api used from a JS

I am developing an application where I provide a JavaScript to my clients (stored on my CDN), and they can load it to their web pages via script tag. This JavaScript does some checks on the DOM and ...
2
votes
1answer
381 views

How to secure refresh token API's?

I have two API's used in auth: api/auth/newtoken: Successfully validates user (i.e. username and password check in DB) and return token (expirers in 3 days) and refreshToken. api/auth/updatetoken: ...
0
votes
1answer
61 views

HMAC and using a cryptographically safe random field as message

Say that I have a big application for which I would like to create a secure API. The standard way to go would be to work with a public API key and a secret API key and provide these to the user. Next, ...
1
vote
1answer
88 views

Vendor Mutual SSL required on behalf of different organisations

I'm a software designer (former IT SysAdmin) trying to wrap my head around some authentication requirements in an API Specification document. Let's say government department (abc.gov) has created a ...
1
vote
1answer
169 views

API Security - Mutual TLS vs TLS with shared secret .

When setting up the security for business to business API integration. We are discussion 2 option Mutual TLS with IP Filtering TLS with a Shared secret and IP Filtering. Which is the more secure ...
20
votes
1answer
24k views

How do you pen test a REST API?

We have a server that is running a REST API on port 443. I'd like to make sure it's secure by doing various pen tests on it. I'm used to doing offensive testing on a webpage where I can see code, and ...
3
votes
1answer
1k views

OAuth2 vs API Key

Our product allows 3rd party components to talk to it via web services using an API key (a 'bearer token'). The developer of the component generates the API key in our app and then stores it with ...
1
vote
3answers
3k views

Safe way to store credentials for an application

I want to use an API for one of the projects on which I am working. What's the good practice/way to store the credentials required for the API? For example, I don't want to later push the project into ...
1
vote
0answers
65 views

How to secure API from spams & crawling

I am working on mobile app and its API which uses a private token for every user for authentication. I want to make sure that no one will misuse the API to crawl my data or to spam my database. Even ...
0
votes
1answer
596 views

CSRF token for API serving application

Currently, my architecture as follows. API is served from api.domain.com. Frontend application is served from frontend.domain.com. I'm concidering two different methods for CSRF protection: Letting ...
1
vote
1answer
733 views

io.fabric.ApiKey. What and why?

While decompiling an APK file for Android, I have found an io.fabric.ApiKey key and value stored in manifest file. My questions are: Can we use the API key with malicious intends? Is it ok to be ...
-3
votes
1answer
298 views

secure public facing wallet API accessed by mobile devices

I am implementing a public mobile wallet application where user can add his own card, like Android Pay, or Samsung Pay on Android device. The standard way how these applications are initially working ...
1
vote
1answer
247 views

Remote Private Key for Certificate Authority

Background I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key ...
2
votes
2answers
3k views

Can the OWASP ZAP check XSS for REST API?

I have a web application and I used OWASP ZAP for checking XSS. I tried two cases as example bellow: URL: localhost:8888/test/login Öogin page HTML: <!DOCTYPE html> <html> <head> &...
5
votes
1answer
2k views

Content-type validation in REST APIs

I'm trying to wrap my head around, why it is advised to validate the content-type, sent by a client to a REST API. OWASP states in their REST Security Cheat Sheet: When POSTing or PUTting new data,...
4
votes
1answer
618 views

Preventing a Burp and Intercept

I have created an authentication API to manage user sessions and the works. To log a user in, the user send their credentials to my API endpoint and it returns “true” or “false” based on their login. ...
4
votes
2answers
767 views

JWT or public-private keys for service to service API calls

I'm looking into setting up authentication between two application services. Service A is going to call service B, and I want service B to only accept (http) calls from service A, nowhere else. I ...
1
vote
2answers
69 views

Security concerns related to API Key in Website

I want to make a weather-forecast website and was planning to make AJAX requests to the openweathermap API to load the weather data. However, I am uncertain on how to properly use the API key. I was ...
2
votes
2answers
126 views

Is it safe to publicly expose key hashes?

I have a simple API which I want to limit users using a key. For each request, the users will need to post the key and the other parameters. For example in R: res <- httr::POST( "api-url", ...
4
votes
2answers
5k views

Do I need to hash or encrypt API keys before storing them in a database?

I'm securing API calls to a REST service I'm building using API Keys. The plan is to: When we get a new client, generate an API Key (a UUID). Email the API key to them. They send the API key on every ...
0
votes
2answers
131 views

Storing password to use later

I have a deployment system with a user interface that is accessible over the Internet. I want to make it more secure by re rolling the password periodically over the API. Is there a safe way I can ...
5
votes
1answer
160 views

Is it worth verifying the request hostname in API-to-API communications?

When authenticating from a browser application to an API layer, you can verify the request origin for CORS requests. I'm aware that this is primarily to prevent CSRF attacks. It doesn't prevent an ...
0
votes
1answer
59 views

Does Windows Authentication Use Secured Connection

I am writing a .NET Web API that will be used in an enterprise environment where users authentication themselves using their active directory credentials, so I am using "Windows Authentication" in IIS ...
9
votes
3answers
5k views

Oauth2 vs APIKey in a server to server communication

A third party service provider is exposing a payment API that we need to integrate on our backend. As transport communication we will consume this API using TLS with Client Certificate and over a MPLS ...
3
votes
1answer
1k views

Secure RESTful api communication between multiple servers

Currently I have the following design: Central cloud hosted server with a REST api Multiple remote servers each with a REST api Data is posted from the remote servers to the central server at ...
4
votes
1answer
106 views

If a user changes password should it make all API keys invalid?

When a user changes their password this will force all users who is logged in on the website via cookies to be forced to login again. However, there is a mobile application that logs in the user via ...
0
votes
1answer
379 views

Can I say that my web app is HIPAA compliant?

My team and I created a web app that transfers data from a VOIP system (recorded calls, voicemails, faxes, texts) to cloud storage (Google Drive, Amazon S3, Box.com). In and of itself, our app follows ...
0
votes
2answers
154 views

What kind of security is needed for simple REST API on Amazon's AWS

I am envisioning a simple REST API for my app only that essentially functions as a proxy server for some organization's API. Thus, no sensitive information is stored or available through the my API. ...
1
vote
2answers
670 views

CSRF with a CORS JSON API [duplicate]

We have api.example.com that communicates with app.example.com, a native Android app and an iOS app. We want to allow other third parties to communicate with the API too if they want, and as such we ...
-1
votes
1answer
224 views

Can unofficial telegram clients read user messages?

There are many unofficial telegram clients out there but i want to know if they can access user messages in plain. In my opinion, message decryption must be done somewhere inside the client app so it'...