Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Filter by
Sorted by
Tagged with
0
votes
0answers
13 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
0
votes
1answer
33 views

Securing implicit tokens (Example: Moltin)

I'm fairly new to security but I'm trying to understand how companies have their APIs set. One such case is Moltin's Implicit Token. Basically they provide you with a read-only (for the most part) ...
2
votes
1answer
80 views

How to securely share sensitive info (such as API keys) with freelancers?

My business partner and I are building a webapplication. We have partnered with some third party services which make use of API (public and secret) keys. The freelance developer we worked with ...
1
vote
1answer
37 views

How to secure embedded code containing REST api call

I am making a Google Analytics like service where you embed generated code into your website and it tracks certain data. I have a backend REST api, but I am not sure how to securely implement a call ...
0
votes
0answers
30 views

Public report/telemetry API

I want to implement a telemetry data sender into my electron app. The API which I want to connect to is public. So any crash reports or any other data from the user is sent to it. The problem is how ...
0
votes
0answers
16 views

Server to Server API Security [duplicate]

Background I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote ...
-1
votes
0answers
25 views

Download Directories on uTorrent Web API [migrated]

I haven't been able to find a definitive answer on what the "Download Directories" is on the uTorrent WebAPI. I wasn't able to find any Web API calls to specify a download directory and when I use the ...
0
votes
3answers
85 views

How to limit web API microservice communication to specific list of machines?

I have an PHP API that I want to be consumed only by one static website. However the HTTP is not secure as from what I suspect any header can be spoofed (IP - I may be wrong here, domain name, and so ...
0
votes
0answers
45 views

How does Google restrict API access by mobile App ID?

Google Cloud Platform API service has an option to restrict API access to specified iOS bundle identifiers. How is Google able to accomplish that since any mobile clients can easily spoof the bundle ...
0
votes
0answers
52 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
1
vote
1answer
67 views

Secure endpoint for root domain only, no subdomains

I have an existing endpoint, for example https://api.example.com/ ... I have an existing CORS policy enabled which only allows access from origin example.com. However, when I visit the endpoint URL ...
3
votes
1answer
93 views

Storage of API authentication token in single-page-applications

I'm building a JSON API. For authentication I plan to use a random-token based approach, with the random token having 256 bits of entropy and generated using a CSRNG. A hash of the token will be ...
1
vote
1answer
136 views

Exploitability of allowed wildcard (*) CORS Origins with Bearer Token Authorization [duplicate]

I'm looking at the following setup. A web application uses a REST API to communicate with the server. All API responses include Origin: *. For authorization Authorization: Bearer <token> is used....
0
votes
2answers
94 views

Can wireshark capture the exact payload and end point of API used by my Mobile APP?

I was just wondering if someone having total control over his/her network, is running my mobile app. Also wireshark is capturing all requests made using the network. My app is calling API endpoint ...
1
vote
1answer
112 views

Swagger on production APIs

What security issues could arise from leaving the Swagger pages on production APIs that expose sensitive data (albeit secured with OAuth)? Are there web crawlers that look to harvest Open API ...
1
vote
1answer
89 views

Should API Secrets used for simple authentication be hashed in the database?

There was a similar question which I found which was asked the better half of a decade ago "Is it okay for API secret to be stored in plain text or decrypt-able?", but the majority of answers seem to ...
0
votes
1answer
47 views

Whats should be TRACE response of an API (if it is not allowed on server)?

I am testing a website and noticed that when I change the GET method of the API request to TRACE, it returns an error 405-Method not allowed in Burp repeater. That's fine. The problem is, lots of ...
0
votes
0answers
35 views

REST API Basic Authentication Use Case

I'm developing REST APIs and would like to know if Basic Authentication will be enough to secure them, or if I should be looking into other authentication methods, like OAuth2. My APIs are setup to ...
0
votes
0answers
44 views

Using Mutual TLS to create api keys

I would just like a sanity check on my plan to implement API authentication/authorization. Authorized URLs are placed in a secure DB The client server places a GET request to api-key service with ...
0
votes
0answers
37 views

Is it safe to use Giphy API keys in public Github repo?

I am making a game of which one of the hidden features is displaying a GIF from Giphy at a fixed command. For this, I am using Giphy API, hosting the game as a website on Github Pages with a public ...
1
vote
0answers
31 views

Is there away to retrieve results (including found vulnerabilities) of a specific scan from one API call?

Is there away to retrieve results (including found vulnerabilities) of a specific scan from one API call? From InsightVm documentation, the GET scan API call returns only scan info with statistics of ...
3
votes
2answers
345 views

Why do we use Oauth2 instead of Basic Auth in server to server communication using SSL?

Why do some API providers ask you to implement Oauth2 in server to server communication that's available only over HTTPS? In the frontend (app or webapp), Oauth2 is useful to protect the user ...
9
votes
2answers
12k views

Store Auth-Token in Cookie or Header?

I do understand that a header is the "cleaner" solution to transport an auth-token from a trusted system to another in a REST call. But when you are in client-side JavaScript code, the world looks ...
0
votes
0answers
43 views

Is it possible to extract data from api response from main domain?

I found an XSS on subdomain.example.com, is it possible to use that xss to extract the response of an api request from the main domain example.com/api/xyz? The xss is on subdomain.example.com and I'd ...
18
votes
2answers
3k views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...
0
votes
2answers
272 views

CORS Anywhere to bypass CSRF protection

CORS Anywhere helps with accessing data from other websites that is normally forbidden by the Same origin policy of Web browsers. Can CORS Anywhere able to bypass CSRF protections? Reason to ask ...
3
votes
1answer
1k views

How to prevent refreshing a stolen access token

The scenario is: you have refresh token that is valid for a longer period of time and an access token that is valid for a shorter period of time. The setup: There is a client, application server and ...
3
votes
1answer
347 views

How to securely store 3rd party API keys directly on web server

I'm building a private web app that I plan to use between myself and a few select friends. Each of us have API keys for a 3rd party service that my web app needs to access so it can call the 3rd party ...
1
vote
1answer
216 views

CORS accepting arbitrary origin with GET but not with OPTIONS

I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *. However, with OPTIONS requests and an arbitrary origin, ...
0
votes
0answers
36 views

what would be the best approach to generate JWT token for server to server communications?

I am planning to develop an authentication service which generates and validates the JWT token for incoming requests. What would be the best challenge mechanism which could be employed to generate the ...
13
votes
1answer
10k views

OIDC Flow for SPA and RESTful API

I'm building a Single-Page App (SPA) and a RESTful API. The API needs security - certain users can only make calls to certain endpoints. I have an external Identity Provider (IdP (Okta)) that I want ...
2
votes
3answers
4k views

How to make sure an API request is coming from a specific domain?

I'm opening up some API access to my site and my users are required to specify from which of their websites, such as example.com, they will make the API requests. I'm wondering if there's any way to ...
0
votes
0answers
27 views

Make an internal API to return client_secret and server token

Given there's an internal API for a URL, how can you make it return client_secret and server token (possibly other sensitive info)? This question is influenced by a bug report filed on hackerone.com ...
0
votes
0answers
125 views

How to find accounts in leaked databases based on the domain name?

I like to find accounts in leaked databases based on the domain name associated with the leaked mail addresses. Public databases such as https://haveibeenpwned.com/ have this ability partly. Searching ...
1
vote
0answers
52 views

Payment gateway API authentication

I've been tasked with building an API that interacts with a couple of payment gateways to create payments. The API has accounts with multiple users and the accounts have payments associated with them....
1
vote
1answer
124 views

Should I report this Google API key disclosure issue or not?

I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to: https://www.googleapis.com/customsearch/v1/...
1
vote
1answer
136 views

How does using an auth server for mobile app and not storing API keys on client add security?

I've been reading about how unsafe and bad and terrible it is to store your API keys inside your mobile app (whatever solution you have for that) and that you should use a separate server for ...
0
votes
0answers
34 views

Does an OAuth1.0a HTTP GET endpoint in my API present a security vulnerability?

I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites. My application can post to Twitter on behalf of a user. This required implementing ...
3
votes
1answer
95 views

Is it ok to use the same SSL certificate for both HTTPS and SOAP-level signing/encryption?

I'm currently looking after an integration platform with SOAP based web service connections out to partner organizations. At the moment, the same SSL certificate is used for both transport level ...
4
votes
1answer
88 views

API pentesting for mobile and web. What's the difference?

So, I have to pentest an API that is both used by a web app and two mobile apps (Android and iOS, obviously). My question is: do I have to test three times (i.e., for each app) or just once (since it'...
3
votes
1answer
208 views

API Key in microservices

Is sending an encrypted connection string as an API Key through headers a good idea? Someone once told me, storing API Keys in a DB is a bad thing to do but I can't seem to figure out how, when in ...
2
votes
2answers
210 views

Security of Publicly exposed REST APIs

We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple ...
2
votes
4answers
101 views

How to stop people from spamming the account creation url on my website [duplicate]

let's say I have a website with an account creation form. How can I stop people from writing a program that automatically submits the form thousands of times, which would fill up my database with junk ...
1
vote
2answers
106 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
1
vote
2answers
190 views

Invalidate API tokens when LDAP user is invalid

I'm using oauth2 and LDAP for authorization and authentication of an API. Authentication flow is given below. User sends LDAP username and password (with password grand type) to the server. Server ...
1
vote
1answer
143 views

Why is PKCE secure against man-in-the-middle attacks?

In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
1
vote
4answers
911 views

How to prevent self-XSS?

I am creating a website which solely uses REST api for all the features and functionality, from signup and login to fetching data and populating the webpage using Mustache as template engine for ...
1
vote
0answers
58 views

Is having multiple access tokens valid at the same time a security risk?

I run an API that allows multiple access tokens (JWT) to be valid for the same account, in order to allow users to sign into the web application and mobile app at the same time. Is this a potential ...
0
votes
0answers
51 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
1answer
39 views

Secure Exchange Rate for Restful API

I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another ...