Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

21
votes
1answer
4k views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
14
votes
10answers
7k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
6
votes
2answers
4k views

How can we protect signup APIs from brute force registration?

This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down. We have an API like POST '/signup' that just ...
12
votes
1answer
4k views

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

While working on a project that used the REST API for Gerrit Code Review I noticed that they do something that I thought was strange Source: To prevent against Cross Site Script Inclusion (XSSI) ...
10
votes
1answer
3k views

What kind of hashing to use for storing REST API tokens in the database?

We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...
6
votes
2answers
435 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
4
votes
1answer
657 views

How to protect API from from malicious usage

We are developing a community portal service using Java-Spring and Angular UI. We are also going to have an Android app soon. Our back-end exposes many services via REST API. There are couple of ...
1
vote
1answer
578 views

What does “don't roll your own security” mean?

I see this saying a lot and agree that you should leave certain things to the tried and true methods, but am unsure to what extent. Does it just mean don't make your own crypto algorithm? I created a ...
8
votes
3answers
309 views

Reason to use only secrets as API keys?

Many APIs protected with API keys only use the secret key (i.e. a password) without something like an account ID or username. For example Stripe API uses the secret key as the username in Basic Auth, ...
8
votes
3answers
4k views

Oauth2 vs APIKey in a server to server communication

A third party service provider is exposing a payment API that we need to integrate on our backend. As transport communication we will consume this API using TLS with Client Certificate and over a MPLS ...
1
vote
3answers
1k views

Storing API tokens safely on Android to identify developer

We're building an Android library for our Rest APIs that app developers will access with a unique token. Since it's a paid service, and it's a per-request or per-install pricing model, how do we ...
3
votes
3answers
2k views

3rd party API access: Is OAuth really required?

Having a web application with a REST API (say, our-app.com), we want to open our API to 3rd party web applications (say, their-app.com). After some research, having read about OAuth, OpenID Connect, ...
2
votes
1answer
2k views

CSRF and JSON APIs

I was searching for an CSRF implementation for Express.js, and i found something that get my atention, in this post it says that a JSON API is nos vulnerable to CRSF attacks... is that correct?? is ...
3
votes
1answer
1k views

How to exploit a misconfigured CORS policy when a per user authorization token is required?

We recently got an API for security audit. The CORS headers of the API seems mis-configured as when we tried requesting the endpoint with http://attacker.com as origin the server returned the ...
3
votes
1answer
2k views

OAuth2 Implicit Flow: Possible Attack Vectors of Refreshing Token via CORS?

We are currently implementing a Single Page Application (Angular2) and thus have run into the standard "how do we secure our backend API" problem. The standard solution to this apparently to use the ...
2
votes
1answer
551 views

Best practices for securing open APIs from quota theft

I know that appKey is not a means of authenticating applications. But I am wondering what are the best practices for avoiding quota theft for open APIs, that are not associated with any user account. ...
1
vote
1answer
201 views

Why mobile phone app sessoins are never timed out?

This question talks about the session time out for web applications. I have noticed that most mobile phone apps I use never ask me to login again after the first login. These mobile apps call web ...
1
vote
1answer
476 views

Security in unofficial telegram apps(that use Telegram API)

I was wondering that can developers of an unofficial Telegram apps gain access to media and files that users send over the app? (Unofficial Telegrams use the Telegram API and connect to Telegram ...
1
vote
3answers
2k views

Safe way to store credentials for an application

I want to use an API for one of the projects on which I am working. What's the good practice/way to store the credentials required for the API? For example, I don't want to later push the project into ...
1
vote
1answer
4k views

How to ensure my API requests are sent using SSL

I have a simple API that is used to send data back and forth between my two sites. This is not a public API that can be accessed by my clients, it is simply a service for the two sites to communicate. ...
0
votes
0answers
46 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...