The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Filter by
Sorted by
Tagged with
8
votes
1answer
2k views

Securing API against DDoS attacks

I have designed a backend service which is only accessible via a custom REST API. As I understand, services such as CloudFlare are designed to protect HTTPS traffic, and do not apply for custom APIs. ...
2
votes
2answers
129 views

PCI DSS Compliance for Client

I'm new to PCI DSS. I'm coding a custom WordPress plugin for a client of ours which shows a form on their websites. This form will take the customers name, email, quote number, amount, and card ...
2
votes
1answer
5k views

How to ensure my API requests are sent using SSL

I have a simple API that is used to send data back and forth between my two sites. This is not a public API that can be accessed by my clients, it is simply a service for the two sites to communicate. ...
0
votes
1answer
796 views

Securing Authentication Tokens Stored in the Server-Side Database

I'm working on extending a web application with a RESTful HTTP-based API. We decided to require the client to supply an authentication token in each request (instead of using sessions or other multi-...
9
votes
2answers
364 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
1
vote
2answers
242 views

How do I secure a nonce value within app whose source code is public?

I am developing a plugin for Nylas N1 (implements Node). The plugin will be using an implicit flow to authenticate the user, as I understand that is the best way to handle client-side applications. I ...
0
votes
1answer
108 views

Can I use this webservice safely?

I'm trying to integrate with my host using their REST webservices. However, the authentication for the webservice only requires two things: An API token which I can retreive from their portal once ...
1
vote
2answers
869 views

Making an API safe and secure

So I have a a website. Now I'm making an App for it. In the app I need to sign the user in. So I'm making an API for it. The problem is, once I make this API. How will I be able to test for robots ...
1
vote
0answers
643 views

Storing password or access token in standalone Java app

I have a simple Java app that use Eclipse JGit to pull remote repositories into the app to analyze and provide the user with code metric details on their projects. This app is supposed to be able to ...
1
vote
1answer
387 views

Why are Synchronization Token and Cookie-to-Header patterns un-natural for Web APIs?

I have heard that CSRF prevention techniques are not natural for Web APIs. For instance, we might have a client application at domainA that implements both the Synchronization Token Pattern and the ...
0
votes
2answers
753 views

Securing Internal Mobile REST API

I am planning to create an internal API for mobile devices for a company. They are planning to use this internal mobile app to get data from custom ERP, uploading contract, etc. Thus, it will be ...
0
votes
3answers
3k views

Encrypting the API response in a single page app

I am building a single-page(React-Redux on FE, Rails-API BE) application which makes a bunch of REST API calls to get certain information for logged-in users. Some subset of that information (...
1
vote
0answers
34 views

Encrypting PKs exposed via an API to protect from DDoS attacks

Here is a simple scenario. I have an endpoint /person/:id that returns persons information from the database. When :id is not known, resource is looked up from the database. A malicious user can use ...
3
votes
2answers
4k views

CORS REST API whitelist

I have a REST API. I want to use this API from multiple web applications. I want to only allow requests from Whitelisted clients. My first point of call would be to add the necessary headers to the ...
1
vote
1answer
588 views

Safe to store API keys in session?

Scenario: App is hosted on a shared server (hosting provider can see config files if they want to). App must use an API key of a 3rd party service. Considering this "tight budget" scenario, would it ...
3
votes
1answer
1k views

What security controls should be in the API Gateway and what in the webservices?

Nowadays webservices are used a lot and a "new" kind of product is in the streets: the API Gateway. This solucion is published to Internet, receives the requests for webservices from external parties ...
1
vote
2answers
358 views

Is this a good enough approach to securing a RESTful API?

I want to use token-based authentication where the user would log in with a username/password combination. The server would make sure the username and password match and then return a token which ...
5
votes
1answer
2k views

Sending non-expiring access token on each request vs using refresh tokens?

When securing REST APIs for mobile applications, what you often see is the use of refresh tokens. They exist because: Access Tokens have expiration date. We don't want the user to have to enter his ...
1
vote
3answers
477 views

OAuth Authentication - Shared Secrets

I am planning to use the Flickr API in a Windows Universal (UWP) application, written in C#. Early on in my prototype I stumbled upon a security flaw that I have been unable to find a reasonable ...
6
votes
2answers
97 views

Should we prevent access to non-sensitive information?

I'm having a discussion with devs as we build out a web app which involves users, user generated content, an admin area, api and static content. Anyone is able to access the majority of template ...
0
votes
1answer
251 views

Serving javascript from an API and having that execute on the client

I have been proposed a solution where our API serves up some JavaScript which will be executed on the client. The code will render some HTML on the client and provide some functionality such as ...
0
votes
1answer
35 views

How would “hardware verified” API calls be constructed?

Problem Thinking about the Snapshat clones, that stole API credentials, and then used an API without permission.. I think the underlying hardware and OS should have prevented this. Proposed ...
6
votes
2answers
5k views

Secure OAuth 2 flow for client-side or mobile app

I'm implementing an API and a client-side web app, and they are supposed to communicate via an API and use OAuth 2 for authentication. I can't get over my confusion on what's the right way to ...
4
votes
1answer
715 views

How to protect API from from malicious usage

We are developing a community portal service using Java-Spring and Angular UI. We are also going to have an Android app soon. Our back-end exposes many services via REST API. There are couple of ...
2
votes
1answer
610 views

Best practices for securing open APIs from quota theft

I know that appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. ...
3
votes
3answers
8k views

Is hashing passwords with bcrypt and a constant salt more unsecure than SHA1?

I've built an API that allows users to submit encrypted data to be stored in the cloud. To retrieve their data, the API requires the user to supply only the MongoDB Object ID that they are given when ...
1
vote
1answer
203 views

Why mobile phone app sessoins are never timed out?

This question talks about the session time out for web applications. I have noticed that most mobile phone apps I use never ask me to login again after the first login. These mobile apps call web ...
2
votes
0answers
62 views

How should I authenticate a third party's users on my platform?

I'm having trouble finding implementation ideas / guidance / examples for an authentication system that has the following properties: Allows a third party to carry out actions on our platform on ...
1
vote
1answer
387 views

SRP, or hash hashes over HTTPS?

I'm designing a web API, which will use credentials from another system to authenticate. The API will require HTTPS, however I still want to avoid sending a basically plaintext password over the wire ...
4
votes
1answer
121 views

Best practices for relatively simple API for our clients

I've been reading a lot about many API security considerations, the differences in terminology, OAUTH, OpenID, etc. Although I understand their absolute necessity when it comes to securing an API ...
1
vote
0answers
79 views

Securing device communication with API back-end with no user interaction

We have remote devices programmed in Python that talk to our back-end to update our database with information gathered from sensors connected to our remote devices. The remote devices are not ...
6
votes
1answer
4k views

Simple, Secure PHP API Design

I'm trying to design a secure RESTful API web service with as few moving parts as possible. I have some questions, and want to make sure my design is secure. For the data transmission level of ...
4
votes
3answers
2k views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
6
votes
2answers
4k views

How can we protect signup APIs from brute force registration?

This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down. We have an API like POST '/signup' that just ...
2
votes
1answer
130 views

OpenID Connect: API access using same identity provider

Does OpenID Connect support the following SSO-like scheme: Both website S and some meta-website M support login using OpenID Connect, e.g. with a Google account. Is it possible for M to access a user'...
1
vote
1answer
170 views

How to avoid abuse of web-server endpoint from a rogue client?

I realized that once a user logs into the application and receives an Auth token there is the potential that they could use that token along with a rogue client to exploit an endpoint that they now ...
2
votes
1answer
248 views

Distribution of Application API Token

I wrote a simple twitter client for command-line use. For such application, twitter requires two types of tokens, namely application identification, user OAuth Token. The second one is to allow the ...
0
votes
2answers
182 views

Using mutual authentication, should I still worry about message integrity and replay attack?

I'm trying to secure a REST API, our situation is that every client connecting to this API will also have a certificate signed by our own CA. Because of this, I think we can use the client certificate ...
2
votes
0answers
419 views

Token based authentication: Why invalidate the token after each request?

I use the gem devise_token_auth while developing an API for a mobile app. Authors claim that: Tokens should be invalidated after each request to the API. This behavior is enabled by default. Can ...
3
votes
3answers
1k views

Risks of securing REST API using SSL?

We are thinking of building a REST API where all calls are over SSL. After successful login subsequent calls will include a token which was returned by the login service. The server will validate ...
24
votes
1answer
5k views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
8
votes
1answer
2k views

What is the purpose of an API Token and an API Secret?

So if a user authenticates to the site using a username/pw, they get a session token which is passed back to the server to validate who they are. However when you use an API like twitter or 4square, ...
2
votes
1answer
911 views

How does Zeus (and other malware) inject code into other processes

Recently, I've been studying how malware works, most recently the infamously known Zeus bot, and I've noticed one thing that I don't seem to understand: The malware is said to be able to hook APIs in ...
0
votes
1answer
75 views

Trusting data from an API

I read an interesting security article recently that amongst other recommendations suggested data from an external API should be treated like user inputed data. Well of course that makes a lot of ...
2
votes
1answer
4k views

How is OAuth2 secure vs man-in-the-middle attacks

I'm currently researching on securing internal API calls and became interested in request signing since it seems quite secure (using a secret that you won't be sending to anyone to sign your request ...
3
votes
3answers
151 views

Is it possible to modify jQuery client code to call a remote API in an unintended way?

Is it possible for someone to modify the JQuery code of a remote page and make it call the remote APIs in a different way than intended? Suppose the website www.domain.com has a jquery.js script ...
4
votes
3answers
112 views

Correctly disclosing Private API security shortcomings

I am hoping I can get some direction on the correct way to go about properly disclosing serious shortcomings with a private web service API (closed source). Initially I assumed that the API would be ...
0
votes
1answer
249 views

How to prevent unintended REST API usage?

For a university project, I am supposed to implement an API that allows storage and retrival of strings. Clients accessing this api can be mobile phone apps and low power embedded devices. The data ...
3
votes
1answer
137 views

Should I make my api calls to update users contain a password or hashed auth key?

So Im creating an API for an app that in the backend involves updating users, deleting users, and some other user related stuff. Im using the slim framework and I was wondering when the user wants to ...
1
vote
1answer
1k views

Secure communication between two REST apis

I'm building an application which stands alone for the most part, but which needs to access another system for private user data. What is a simple and safe method of securing that private data? We ...