Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Filter by
Sorted by
Tagged with
4
votes
1answer
679 views

How to protect API from from malicious usage

We are developing a community portal service using Java-Spring and Angular UI. We are also going to have an Android app soon. Our back-end exposes many services via REST API. There are couple of ...
2
votes
1answer
575 views

Best practices for securing open APIs from quota theft

I know that appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. ...
3
votes
3answers
7k views

Is hashing passwords with bcrypt and a constant salt more unsecure than SHA1?

I've built an API that allows users to submit encrypted data to be stored in the cloud. To retrieve their data, the API requires the user to supply only the MongoDB Object ID that they are given when ...
1
vote
1answer
201 views

Why mobile phone app sessoins are never timed out?

This question talks about the session time out for web applications. I have noticed that most mobile phone apps I use never ask me to login again after the first login. These mobile apps call web ...
2
votes
0answers
61 views

How should I authenticate a third party's users on my platform?

I'm having trouble finding implementation ideas / guidance / examples for an authentication system that has the following properties: Allows a third party to carry out actions on our platform on ...
1
vote
1answer
368 views

SRP, or hash hashes over HTTPS?

I'm designing a web API, which will use credentials from another system to authenticate. The API will require HTTPS, however I still want to avoid sending a basically plaintext password over the wire ...
4
votes
1answer
118 views

Best practices for relatively simple API for our clients

I've been reading a lot about many API security considerations, the differences in terminology, OAUTH, OpenID, etc. Although I understand their absolute necessity when it comes to securing an API ...
1
vote
0answers
79 views

Securing device communication with API back-end with no user interaction

We have remote devices programmed in Python that talk to our back-end to update our database with information gathered from sensors connected to our remote devices. The remote devices are not ...
6
votes
1answer
4k views

Simple, Secure PHP API Design

I'm trying to design a secure RESTful API web service with as few moving parts as possible. I have some questions, and want to make sure my design is secure. For the data transmission level of ...
3
votes
3answers
2k views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
6
votes
2answers
4k views

How can we protect signup APIs from brute force registration?

This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down. We have an API like POST '/signup' that just ...
2
votes
1answer
130 views

OpenID Connect: API access using same identity provider

Does OpenID Connect support the following SSO-like scheme: Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a user'...
1
vote
1answer
168 views

How to avoid abuse of web-server endpoint from a rogue client?

I realized that once a user logs into the application and receives an Auth token there is the potential that they could use that token along with a rogue client to exploit an endpoint that they now ...
2
votes
1answer
241 views

Distribution of Application API Token

I wrote a simple twitter client for command-line use. For such application, twitter requires two types of tokens, namely application identification, user OAuth Token. The second one is to allow the ...
0
votes
2answers
167 views

Using mutual authentication, should I still worry about message integrity and replay attack?

I'm trying to secure a REST API, our situation is that every client connecting to this API will also have a certificate signed by our own CA. Because of this, I think we can use the client certificate ...
2
votes
0answers
400 views

Token based authentication: Why invalidate the token after each request?

I use the gem devise_token_auth while developing an API for a mobile app. Authors claim that: Tokens should be invalidated after each request to the API. This behavior is enabled by default. Can ...
3
votes
3answers
1k views

Risks of securing REST API using SSL?

We are thinking of building a REST API where all calls are over SSL. After successful login subsequent calls will include a token which was returned by the login service. The server will validate ...
22
votes
1answer
4k views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
7
votes
1answer
2k views

What is the purpose of an API Token and an API Secret?

So if a user authenticates to the site using a username/pw, they get a session token which is passed back to the server to validate who they are. However when you use an API like twitter or 4square, ...
2
votes
1answer
882 views

How does Zeus (and other malware) inject code into other processes

Recently, I've been studying how malware works, most recently the infamously known Zeus bot, and I've noticed one thing that I don't seem to understand: The malware is said to be able to hook APIs in ...
0
votes
1answer
73 views

Trusting data from an API

I read an interesting security article recently that amongst other recommendations suggested data from an external API should be treated like user inputed data. Well of course that makes a lot of ...
1
vote
1answer
4k views

How is OAuth2 secure vs man-in-the-middle attacks

I'm currently researching on securing internal API calls and became interested in request signing since it seems quite secure (using a secret that you won't be sending to anyone to sign your request ...
3
votes
3answers
150 views

Is it possible to modify jQuery client code to call a remote API in an unintended way?

Is it possible for someone to modify the JQuery code of a remote page and make it call the remote APIs in a different way than intended? Suppose the website www.domain.com has a jquery.js script ...
4
votes
3answers
110 views

Correctly disclosing Private API security shortcomings

I am hoping I can get some direction on the correct way to go about properly disclosing serious shortcomings with a private web service API (closed source). Initially I assumed that the API would be ...
0
votes
1answer
243 views

How to prevent unintended REST API usage?

For a university project, I am supposed to implement an API that allows storage and retrival of strings. Clients accessing this api can be mobile phone apps and low power embedded devices. The data ...
3
votes
1answer
137 views

Should I make my api calls to update users contain a password or hashed auth key?

So Im creating an API for an app that in the backend involves updating users, deleting users, and some other user related stuff. Im using the slim framework and I was wondering when the user wants to ...
1
vote
1answer
994 views

Secure communication between two REST apis

I'm building an application which stands alone for the most part, but which needs to access another system for private user data. What is a simple and safe method of securing that private data? We ...
7
votes
1answer
375 views

Impact of using a NON-SSL/TLS connection for API calls on same server

I have two domains hosted on the same server, Domain A and Domain B, both domains have different IP addresses, assuming IPs 1.1.1.1 for Domain A, and 2.2.2.2 for Domain B. Each domain has a different ...
1
vote
3answers
291 views

API Method Parameter Enumeration via Web Browser

I am obligated by contract to prevent enumeration of an API method's parameters but cannot achieve it. When I send a blank request to the API server in a web browser, the server responds with the ...
2
votes
1answer
591 views

Securing APIs from Rogue/Fake iOS or Android apps?

How do you protect a non-public web API from a malicious app where a developer has discovered how to perform some requests? Take Instagram's app as an example: Instagram does not have a public API ...
8
votes
1answer
697 views

Automatically determining whether particular product version is vulnerable?

I'm building a system that contains a lot of data about different versions of various networking software (client software, servers, etc) in a human-readable format. Is there an API that I could query ...
1
vote
1answer
279 views

Storing encrypted data readable only by user but created by server

Context I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in ...
1
vote
3answers
1k views

Storing API tokens safely on Android to identify developer

We're building an Android library for our Rest APIs that app developers will access with a unique token. Since it's a paid service, and it's a per-request or per-install pricing model, how do we ...
2
votes
1answer
3k views

Token based approach to authentication over SSL Rest API - refresh tokens

I'm quite a newbie at security. I'm developing an android app with a token based approach to authentication. I'm not using Oauth as the OAuth 2.0 is not an authentication protocol but rather used to ...
3
votes
1answer
77 views

SSL between websites on the same server

I have deployment that includes a public asp.net website and an internal webAPI both installed on the same machine. The webAPI will only communicate with the website. For example, it will not be ...
0
votes
0answers
214 views

Youtube API security

I was playing about with youtube's API yesterday and did some research about its security. Now.. I have a website which I would like to apply Youtube API for it and I just wonder how NON-secure is to ...
1
vote
1answer
941 views

How to store a token of a restful API?

It's a basic question, but I see in a lot of tutorials of authentication in restful webservices that some user goes to a website and register yourself with an ID and a password, after this ...
2
votes
1answer
788 views

Encrypt/sign a client-to-API request?

We are building a JSON API on top of our Ruby on Rails Web application, using JSONAPI::Resources to expose endpoints and Doorkeeper to handle user authentication. Most of our API endpoints will be ...
0
votes
0answers
2k views

Secure REST API using Public/Private keys?

I was having a conversation with some programmer friends about securing an API without server modification. Only SFTP access to the filesystem is allowed and OpenSSL extension is installed, the admin ...
2
votes
2answers
698 views

REST Services: Limiting the concurrency of a login endpoint

Scenario: A botnet is recruited to try to authenticate against a website or service with each bot trying infrequently using a common password and a list of 'real' email addresses, avoiding the ...
2
votes
1answer
274 views

What reasons are there to not just send the API key as an HTTP header over HTTPS?

I've been recently struggling to use Microsoft's Azure platform (which has been an unfathomable pain in the ass). One early thing I noted was how the authentication was unexpectedly more difficult ...
5
votes
1answer
20k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: http://www.asp.net/web-api/overview/security/working-with-ssl-in-web-...
17
votes
1answer
34k views

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a 20-...
-1
votes
2answers
93 views

Validate API caller domain (or any other related solution)

I am quite new to creating services using PHP-cURL. I want to offer some data/service to only registered domains. I know that I can identify these domains using app ID and API keys for data encryption....
0
votes
1answer
59 views

How do API's authenticate a user?

I've read many documents about API's but they don't seem to mention API's for private accounts instead of publicly accessible information. How does an API work to request private account data? How ...
0
votes
3answers
2k views

Securing REST API with HMAC and basic auth

I was wondering if giving users choice of a method for securing their access to API would be a good idea. Background: We are creating and deploying applications for our customers, which help them do ...
17
votes
2answers
20k views

HTTPS POST request header versus request body

Is there any security difference between placing sensitive data, such as an API key in a POST request header versus the POST request body assuming the API server is HTTPS-only? While you frequently ...
6
votes
1answer
4k views

Why use a proxy to hide OAuth client credentials in password grant calls?

In a November 2014 article by Alex Bilbie, OAuth users were advised against making the client send its credentials (client_id and client_secret) when performing Resource Owner Password grant calls. ...
0
votes
1answer
507 views

Is sharing a CSRF token between Rails apps secure?

We use an nginx reverse proxy to host two Rails apps under the same domain (one /path leads to another 'secondary' app). The 'secondary' app that lives under a path consumes REST APIs from the 'main' ...
2
votes
2answers
420 views

How secure is loging into internet banking via an https library?

My bank does not have an API so I want my server to log in and check incoming payments to notify me if a client has paid or not. I would like the server to log in and scrape using Beautifulsoup and ...