Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Filter by
Sorted by
Tagged with
0
votes
1answer
691 views

CSRF token for API serving application

Currently, my architecture as follows. API is served from api.domain.com. Frontend application is served from frontend.domain.com. I'm concidering two different methods for CSRF protection: Letting ...
1
vote
1answer
899 views

io.fabric.ApiKey. What and why?

While decompiling an APK file for Android, I have found an io.fabric.ApiKey key and value stored in manifest file. My questions are: Can we use the API key with malicious intends? Is it ok to be ...
-3
votes
1answer
300 views

secure public facing wallet API accessed by mobile devices

I am implementing a public mobile wallet application where user can add his own card, like Android Pay, or Samsung Pay on Android device. The standard way how these applications are initially working ...
1
vote
1answer
279 views

Remote Private Key for Certificate Authority

Background I've been playing around with the idea of using an protected private key wrapped by an API, like Azure KeyVault or Amazon KMS keys to sign certificates for internal Private Key ...
2
votes
2answers
3k views

Can the OWASP ZAP check XSS for REST API?

I have a web application and I used OWASP ZAP for checking XSS. I tried two cases as example bellow: URL: localhost:8888/test/login Öogin page HTML: <!DOCTYPE html> <html> <head> &...
5
votes
1answer
2k views

Content-type validation in REST APIs

I'm trying to wrap my head around, why it is advised to validate the content-type, sent by a client to a REST API. OWASP states in their REST Security Cheat Sheet: When POSTing or PUTting new data,...
4
votes
1answer
705 views

Preventing a Burp and Intercept

I have created an authentication API to manage user sessions and the works. To log a user in, the user send their credentials to my API endpoint and it returns “true” or “false” based on their login. ...
5
votes
2answers
874 views

JWT or public-private keys for service to service API calls

I'm looking into setting up authentication between two application services. Service A is going to call service B, and I want service B to only accept (http) calls from service A, nowhere else. I ...
2
votes
2answers
74 views

Security concerns related to API Key in Website

I want to make a weather-forecast website and was planning to make AJAX requests to the openweathermap API to load the weather data. However, I am uncertain on how to properly use the API key. I was ...
2
votes
2answers
132 views

Is it safe to publicly expose key hashes?

I have a simple API which I want to limit users using a key. For each request, the users will need to post the key and the other parameters. For example in R: res <- httr::POST( "api-url", ...
6
votes
2answers
6k views

Do I need to hash or encrypt API keys before storing them in a database?

I'm securing API calls to a REST service I'm building using API Keys. The plan is to: When we get a new client, generate an API Key (a UUID). Email the API key to them. They send the API key on every ...
0
votes
2answers
133 views

Storing password to use later

I have a deployment system with a user interface that is accessible over the Internet. I want to make it more secure by re rolling the password periodically over the API. Is there a safe way I can ...
5
votes
1answer
165 views

Is it worth verifying the request hostname in API-to-API communications?

When authenticating from a browser application to an API layer, you can verify the request origin for CORS requests. I'm aware that this is primarily to prevent CSRF attacks. It doesn't prevent an ...
0
votes
1answer
64 views

Does Windows Authentication Use Secured Connection

I am writing a .NET Web API that will be used in an enterprise environment where users authentication themselves using their active directory credentials, so I am using "Windows Authentication" in IIS ...
11
votes
3answers
6k views

Oauth2 vs APIKey in a server to server communication

A third party service provider is exposing a payment API that we need to integrate on our backend. As transport communication we will consume this API using TLS with Client Certificate and over a MPLS ...
3
votes
1answer
1k views

Secure RESTful api communication between multiple servers

Currently I have the following design: Central cloud hosted server with a REST api Multiple remote servers each with a REST api Data is posted from the remote servers to the central server at ...
4
votes
1answer
110 views

If a user changes password should it make all API keys invalid?

When a user changes their password this will force all users who is logged in on the website via cookies to be forced to login again. However, there is a mobile application that logs in the user via ...
0
votes
1answer
404 views

Can I say that my web app is HIPAA compliant?

My team and I created a web app that transfers data from a VOIP system (recorded calls, voicemails, faxes, texts) to cloud storage (Google Drive, Amazon S3, Box.com). In and of itself, our app follows ...
0
votes
2answers
156 views

What kind of security is needed for simple REST API on Amazon's AWS

I am envisioning a simple REST API for my app only that essentially functions as a proxy server for some organization's API. Thus, no sensitive information is stored or available through the my API. ...
1
vote
2answers
704 views

CSRF with a CORS JSON API [duplicate]

We have api.example.com that communicates with app.example.com, a native Android app and an iOS app. We want to allow other third parties to communicate with the API too if they want, and as such we ...
-1
votes
1answer
243 views

Can unofficial telegram clients read user messages?

There are many unofficial telegram clients out there but i want to know if they can access user messages in plain. In my opinion, message decryption must be done somewhere inside the client app so it'...
0
votes
2answers
974 views

Is it secure to auth API requests using an RSA? [closed]

I would like to give our users access to private data using an API. I don't want to store the API credentials in my database. (Same reason I don't store the password in plain in the database. I have ...
10
votes
1answer
885 views

How vulnerable is connecting Android App to PHP API with prewritten queries

I have built a PHP API which queries data from some tables in an online SQL database. The credentials with which it connects to the database are saved in another file, and are loaded at start. The ...
2
votes
0answers
640 views

Web API authentication with Kerberos

We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via ...
1
vote
2answers
411 views

How does AWS authentication work?

AWS APIs use access key ID and secret access key for authenticating the API calls. How exactly does it work and how is it different from SSH ?
3
votes
1answer
1k views

iOS : Possible cache DB security issue?

I currently found something interesting when browsing my iPhone app's cache.db file. There is a table called cfurl_cache_receiver_data and there is a column called receiver_data. This contains all ...
1
vote
1answer
683 views

What to do for my Web API authentication scheme?

I've been reading a lot lately about Web API authentication mechanisms and I'm a little bit confused regarding how to implement my Web API authentication mechanism, I'm thinking on using Token based ...
2
votes
2answers
177 views

How safe is this scenario security wise

In a project I am working on, I needed to write some cron job scripts, which purpose is, to access some external API's, which have information that shouldn't be accessible by the public. The external ...
0
votes
1answer
165 views

Finding Windows API Vulnerabilities

Currently I'm reading about the Windows API's like CreateProcess and others. Also I took a look into the Source of the Powershell Script which used the MS16-032 vulnerability. My Question is: Which ...
1
vote
1answer
1k views

Secure way to store sensitive API details of users (localStorage or database?)

I am playing around with the idea of creating a website for cryptocurrencies, where a user can sign up on my website, enter his API details for one of the exchange markets that I will support, which ...
14
votes
10answers
8k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
2
votes
1answer
63 views

Purpose of using API Key in addition to password

It was suggested to my coworker and me to password protect our API in addition to requiring an API key. This doesn't seem like it's making anything safer since if the threat gained access to our API ...
5
votes
2answers
2k views

OWASP Secure Headers for Web Services

Is the following headers mandatory for a web service that handles POST requests and return data using SOAP? HTTP Strict Transport Security (HSTS) X-Frame-Options X-XSS-Protection X-Content-Type-...
1
vote
1answer
314 views

End to end ecncryption and solution to password lost

I'm implementing field level end to end encryption (e2ee) to customer data stored in a DB, this DB is using by a RESTFUL web application (angular) through a web API. API generates an encryption key ...
3
votes
1answer
2k views

Securing an API with Django Rest Framework

I'm looking to implement a public (edit: rather, an authenticated api exposed to the internet) API on top of Django, and Django Rest Framework seems to be a popular choice. The APIs that I'm used to ...
1
vote
2answers
187 views

How to secure email validation endpoint?

We have email validation in our registration form (an Ajax call to a REST endpoint to validate an email address when a user enters it). Lets say a normal form first name, Last name, Email, Password, ...
1
vote
0answers
64 views

Security practices to securely poll authenticated 3rd party API on behalf of clients

It turns out there is a need for our application to be able to poll data at a specific schedule from external API on behalf of clients. The API can be any rest API that the client would choose. We ...
1
vote
0answers
347 views

Securing a B2B (server to server) multi-tenant REST API [closed]

I am developing a B2B multi-tenant REST API which will be invoked by tenant’s (wallet provider) server application (secure or confidential client) on to perform some operations on its user’s accounts. ...
2
votes
2answers
464 views

Is an API password safe in a mobile application?

I want to let customers use our API in their mobile applications i.e ones that they develop. I have never developed for mobile so don't know if having the clients secretAPI key stored in the app is ...
0
votes
1answer
677 views

API credentials visible when creating Github pages website?

I am in the planning stages of creating a rmarkdown website and publishing it using Github pages. The actual content of the website will be a flexdashboard or a Shiny app(still deciding). Regardless, ...
0
votes
1answer
1k views

How can I prevent requests from the browser console while still using ajax? [duplicate]

I have a publicly available API endpoint. I have to prevent a simple $.ajax script from downloading all of the exposed data within seconds and at least force a page refresh everytime a new request ...
13
votes
1answer
5k views

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

While working on a project that used the REST API for Gerrit Code Review I noticed that they do something that I thought was strange Source: To prevent against Cross Site Script Inclusion (XSSI) ...
2
votes
1answer
2k views

How to secure handshake system-to-system in RESTful API calls without user/pass?

I have system X from another department in our company that sends basic user info (not passwords) to my system using RESTful API. Both systems are using subdomains of the same domain but reside on ...
1
vote
1answer
679 views

What does “don't roll your own security” mean?

I see this saying a lot and agree that you should leave certain things to the tried and true methods, but am unsure to what extent. Does it just mean don't make your own crypto algorithm? I created a ...
4
votes
1answer
5k views

How to protect API Key in Android application

I was working on one Android App which was communicating with RESTFull server. We made an API Key which was inserted in header of GET and POST requests. This API Key was stored in Strings. App is no ...
3
votes
0answers
77 views

Prevent developer/owner from seeing user data with insecure API

I am building a chatbot for my university in GroupMe, which very popular there. The bot will, for example, allow users to send messages to their chat groups like /menus (assuming that "/" is the ...
1
vote
2answers
1k views

Native app: login with username and password

I have web api, for now it uses oauth2 authorization code grant type to communicate with my native application. Web browser will be opened inside app to input username and password, open authorize ...
7
votes
1answer
4k views

How to allow users to connect from multiple devices with refresh tokens?

This question follows my previous one: How to securely keep my users signed in with refresh tokens? What I got from this previous question, is that we need: short-lived access tokens long-lived one-...
0
votes
0answers
18 views

How google API verifies a usage by specific bundleID (apple) or andorid app?

i'm reading about how google restricts the usage of the API keys. they have 2 options - by bundle ID and by application's SHA-1 fingerprint. I'm guessing that this info is sent along the request from ...
3
votes
1answer
815 views

JWT authentication and authorization schema

I was going through Oauth2 docs and thought it was kind of permissive security wise, so i tried to implement JWT tokens with a special scheme like in the picture for a mobile app communicating with a ...