Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Filter by
Sorted by
Tagged with
0
votes
2answers
808 views

Is it secure to auth API requests using an RSA? [closed]

I would like to give our users access to private data using an API. I don't want to store the API credentials in my database. (Same reason I don't store the password in plain in the database. I have ...
10
votes
1answer
859 views

How vulnerable is connecting Android App to PHP API with prewritten queries

I have built a PHP API which queries data from some tables in an online SQL database. The credentials with which it connects to the database are saved in another file, and are loaded at start. The ...
2
votes
0answers
608 views

Web API authentication with Kerberos

We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via ...
1
vote
2answers
372 views

How does AWS authentication work?

AWS APIs use access key ID and secret access key for authenticating the API calls. How exactly does it work and how is it different from SSH ?
3
votes
1answer
1k views

iOS : Possible cache DB security issue?

I currently found something interesting when browsing my iPhone app's cache.db file. There is a table called cfurl_cache_receiver_data and there is a column called receiver_data. This contains all ...
1
vote
1answer
671 views

What to do for my Web API authentication scheme?

I've been reading a lot lately about Web API authentication mechanisms and I'm a little bit confused regarding how to implement my Web API authentication mechanism, I'm thinking on using Token based ...
2
votes
2answers
173 views

How safe is this scenario security wise

In a project I am working on, I needed to write some cron job scripts, which purpose is, to access some external API's, which have information that shouldn't be accessible by the public. The external ...
0
votes
1answer
162 views

Finding Windows API Vulnerabilities

Currently I'm reading about the Windows API's like CreateProcess and others. Also I took a look into the Source of the Powershell Script which used the MS16-032 vulnerability. My Question is: Which ...
1
vote
1answer
1k views

Secure way to store sensitive API details of users (localStorage or database?)

I am playing around with the idea of creating a website for cryptocurrencies, where a user can sign up on my website, enter his API details for one of the exchange markets that I will support, which ...
14
votes
10answers
7k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
2
votes
1answer
62 views

Purpose of using API Key in addition to password

It was suggested to my coworker and me to password protect our API in addition to requiring an API key. This doesn't seem like it's making anything safer since if the threat gained access to our API ...
5
votes
2answers
2k views

OWASP Secure Headers for Web Services

Is the following headers mandatory for a web service that handles POST requests and return data using SOAP? HTTP Strict Transport Security (HSTS) X-Frame-Options X-XSS-Protection X-Content-Type-...
1
vote
1answer
269 views

End to end ecncryption and solution to password lost

I'm implementing field level end to end encryption (e2ee) to customer data stored in a DB, this DB is using by a RESTFUL web application (angular) through a web API. API generates an encryption key ...
3
votes
1answer
2k views

Securing an API with Django Rest Framework

I'm looking to implement a public (edit: rather, an authenticated api exposed to the internet) API on top of Django, and Django Rest Framework seems to be a popular choice. The APIs that I'm used to ...
1
vote
2answers
180 views

How to secure email validation endpoint?

We have email validation in our registration form (an Ajax call to a REST endpoint to validate an email address when a user enters it). Lets say a normal form first name, Last name, Email, Password, ...
1
vote
0answers
63 views

Security practices to securely poll authenticated 3rd party API on behalf of clients

It turns out there is a need for our application to be able to poll data at a specific schedule from external API on behalf of clients. The API can be any rest API that the client would choose. We ...
1
vote
0answers
311 views

Securing a B2B (server to server) multi-tenant REST API [closed]

I am developing a B2B multi-tenant REST API which will be invoked by tenant’s (wallet provider) server application (secure or confidential client) on to perform some operations on its user’s accounts. ...
2
votes
2answers
425 views

Is an API password safe in a mobile application?

I want to let customers use our API in their mobile applications i.e ones that they develop. I have never developed for mobile so don't know if having the clients secretAPI key stored in the app is ...
-1
votes
1answer
593 views

API credentials visible when creating Github pages website?

I am in the planning stages of creating a rmarkdown website and publishing it using Github pages. The actual content of the website will be a flexdashboard or a Shiny app(still deciding). Regardless, ...
0
votes
1answer
1k views

How can I prevent requests from the browser console while still using ajax? [duplicate]

I have a publicly available API endpoint. I have to prevent a simple $.ajax script from downloading all of the exposed data within seconds and at least force a page refresh everytime a new request ...
12
votes
1answer
5k views

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

While working on a project that used the REST API for Gerrit Code Review I noticed that they do something that I thought was strange Source: To prevent against Cross Site Script Inclusion (XSSI) ...
2
votes
1answer
2k views

How to secure handshake system-to-system in RESTful API calls without user/pass?

I have system X from another department in our company that sends basic user info (not passwords) to my system using RESTful API. Both systems are using subdomains of the same domain but reside on ...
1
vote
1answer
610 views

What does “don't roll your own security” mean?

I see this saying a lot and agree that you should leave certain things to the tried and true methods, but am unsure to what extent. Does it just mean don't make your own crypto algorithm? I created a ...
4
votes
1answer
5k views

How to protect API Key in Android application

I was working on one Android App which was communicating with RESTFull server. We made an API Key which was inserted in header of GET and POST requests. This API Key was stored in Strings. App is no ...
3
votes
0answers
73 views

Prevent developer/owner from seeing user data with insecure API

I am building a chatbot for my university in GroupMe, which very popular there. The bot will, for example, allow users to send messages to their chat groups like /menus (assuming that "/" is the ...
1
vote
2answers
1k views

Native app: login with username and password

I have web api, for now it uses oauth2 authorization code grant type to communicate with my native application. Web browser will be opened inside app to input username and password, open authorize ...
7
votes
1answer
3k views

How to allow users to connect from multiple devices with refresh tokens?

This question follows my previous one: How to securely keep my users signed in with refresh tokens? What I got from this previous question, is that we need: short-lived access tokens long-lived one-...
0
votes
0answers
18 views

How google API verifies a usage by specific bundleID (apple) or andorid app?

i'm reading about how google restricts the usage of the API keys. they have 2 options - by bundle ID and by application's SHA-1 fingerprint. I'm guessing that this info is sent along the request from ...
3
votes
1answer
781 views

JWT authentication and authorization schema

I was going through Oauth2 docs and thought it was kind of permissive security wise, so i tried to implement JWT tokens with a special scheme like in the picture for a mobile app communicating with a ...
1
vote
1answer
3k views

HTTP API request body encryption

I am building a Web API for a simple game. The API is SSL-only and uses limited-time tokens for user authentication. I would like to encrypt the contents of a specific request to prevent cheating. I ...
0
votes
1answer
2k views

Enforcing HTTPS Only With REST API

I'm developing a REST API that may take in private information. To make it secure, I want to have the API only accessible using HTTPS. Basically, what is the best way to enforce HTTPS only? Here are ...
4
votes
3answers
984 views

What is the use of nonces in HTTPS APIs

I have used APIs that require a nonce for every request. If HTTPS requests are not replayable, seen here https://stackoverflow.com/a/2770133/2800469, what is the reason to require nonces for HTTPS ...
1
vote
3answers
189 views

Securing a rest API with one client

I am about to develop a REST API that will only have one "user" and I am curious about how I should implement security to make it as secure as possible(hopefully implementing some protocol that I am ...
4
votes
1answer
827 views

User authentication in JavaScript application

I'm developping a web application which will be communicating with a server over WebAPI. The server side will be on Azure and the client side will be on custom hosting with a JavaScript application (...
1
vote
1answer
128 views

Auth in query string [duplicate]

Heroku got interesting blog post: For security reasons, we will be sunsetting support of auth in query string sooner, which we will announce in the Changelog. However, no explanation is provided ...
0
votes
1answer
339 views

Where should the authorization logic go in an api based application?

I have a brand new Rails api based application, where i need to implement authorization. Overall Architecture: React frontend -> Rails API layer -> Rails model/server layer While exploring ...
2
votes
2answers
156 views

Using JTWs in OAuth Implementation

I am currently building an api for an app to communicate with. The api endpoints will be protected, so I'd like to use an OAuth flow with JWTs for security. My flow will go something like this: ...
5
votes
2answers
4k views

Preventing resubmission and replay attack using client nonce in REST API

I have a REST API backend which has HTTPS (and blocked HTTP) and use JWT as the authentication mechanism. Client side is iOS/Android App. I want to add a layer of safeguard on critical API by using ...
1
vote
1answer
367 views

How do I securely store a API key in a PC program? [duplicate]

I have a PC program which uses a API. I have the API key stored in the code, because there is no other way I can think of. Since I have no code/string obfuscator, how do I secure the API key, so no ...
1
vote
0answers
1k views

How website hide api response?

I build a web application and get data via REST API. eg: https://mywebapi.com/product/{productId} then I get json response and use the json data response in my web page https://myweb.com/product/{...
2
votes
1answer
756 views

Using Simple JWT for Public Facing API Auth

I'm looking at security methods for APIs. Using JWT access tokens after client login with user/password will work well for internal web apps using our own APIs. However, I'm looking at how we should ...
0
votes
1answer
615 views

Windows API call sequence monitoring

I need to monitor an API call sequence created by a process running on Microsoft Windows, to analyze malware behavior. I know we can do user mode or kernel mode monitoring. I have tried some tools ...
2
votes
1answer
503 views

REST API and security

In a few occasions, pen-testers asked me to avoid the use of detailed HTTP return codes that could reveal information to an attacker. For example, they said that it is wrong to return a 404 when the ...
0
votes
2answers
67 views

How to authorize a public client

I've created an application that is exposed via a web service and an Android client that communicates with that web service. Is there a way to have the client authenticate with the web service so that ...
1
vote
1answer
42 views

Would a custom random string do what I want?

Upfront, please overlook my naivety. I have a service app that talks to a web api. I only want the service to talk to the web api, nothing else. Means I need to secure it and I'm trying to understand ...
1
vote
1answer
128 views

Authenticating requests between APIs

I am building an application (“A”) that can interface with a 3rd Party data API (“B”). A is commissioned by Organization “X”, which has data on B. Users of A need access to Org X’s data on B. ...
3
votes
2answers
776 views

securities concerns about calling REST API from multiple servers

There is a master web application that needs to call REST APIs from servers of other applications. I can think of two ways to achieve it: a). call APIs on the front-end of the master application(...
2
votes
2answers
245 views

DRM - Make sure that a SDK is used by the client legally

We are an IT startup which provides some clients with a Software Development Kit, which may be used by the client within a specific environment, according to some terms and legal agreement. Especially,...
6
votes
3answers
961 views

Why Youtube, or any other Google services use account binded authorization key plain in the url?

in the past I expirmented with Google available api tools, like the Drive and Youtube api's. The way it works is after you purchase a deveopler account, you are granted to many of Google services ...
1
vote
3answers
2k views

Securing a private API that's visible on the public Internet

I'm making an API for my own software. The API currently used for registering users, viewing users information and updating users information. In the future it will be used for billing, support etc .....