Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

59
votes
7answers
9k views

Is exposing the server time a security risk?

If I create a servlet that would return the server time publicly (no need for authentication), would this be a security issue? I couldn't think of any issue with this, but somehow something tells me I ...
36
votes
11answers
10k views

Returning the wrong HTTP response code on purpose?

I'm writing a simple REST API, and I want to restrict access to my mobile-client only. In other words, I'm trying to prevent a malicious user from e.g. using curl to make an unauthorized POST request. ...
22
votes
1answer
4k views

How does a refresh token help? [duplicate]

I have a basic doubt or apparently am missing out on something fundamental. When talking about an Android app that talks to the backend using APIs, the access to the resources/APIs are protected ...
20
votes
1answer
23k views

How do you pen test a REST API?

We have a server that is running a REST API on port 443. I'd like to make sure it's secure by doing various pen tests on it. I'm used to doing offensive testing on a webpage where I can see code, and ...
17
votes
2answers
20k views

HTTPS POST request header versus request body

Is there any security difference between placing sensitive data, such as an API key in a POST request header versus the POST request body assuming the API server is HTTPS-only? While you frequently ...
17
votes
2answers
3k views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...
17
votes
1answer
34k views

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a 20-...
14
votes
10answers
7k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
13
votes
1answer
10k views

OIDC Flow for SPA and RESTful API

I'm building a Single-Page App (SPA) and a RESTful API. The API needs security - certain users can only make calls to certain endpoints. I have an external Identity Provider (IdP (Okta)) that I want ...
12
votes
1answer
5k views

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

While working on a project that used the REST API for Gerrit Code Review I noticed that they do something that I thought was strange Source: To prevent against Cross Site Script Inclusion (XSSI) ...
12
votes
2answers
16k views

JWT token login and logout

Hi I am creating mobile native application that uses REST API endpoints to communicate with server side. I have had previous experience developing native clients, but I have simple token (random ...
11
votes
1answer
7k views

Security Headers for a web API

I just got a setup, a golang web api behind a caddy server that has HTTPS by default via Let's Encrypt, the server proxies all requests to the web api. So I went around to test my webserver "security" ...
11
votes
1answer
3k views

What kind of hashing to use for storing REST API tokens in the database?

We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...
10
votes
2answers
2k views

Public API with authorization token — is it possible to protect the demo token?

I have a REST API for running some calculations and returning the result, with a very simple token system where only authorized users can use the API. The user adds their token to the query like this:...
10
votes
1answer
847 views

How vulnerable is connecting Android App to PHP API with prewritten queries

I have built a PHP API which queries data from some tables in an online SQL database. The credentials with which it connects to the database are saved in another file, and are loaded at start. The ...
9
votes
3answers
486 views

I don't understand what's wrong with just using cookies for authentication?

I'm writing an app-server and there is an option to just use secure cookies for authentication. Here's how it seems to work: You define a 32-byte secret key on the server When the user logs in, you ...
9
votes
2answers
363 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
8
votes
2answers
11k views

Store Auth-Token in Cookie or Header?

I do understand that a header is the "cleaner" solution to transport an auth-token from a trusted system to another in a REST call. But when you are in client-side JavaScript code, the world looks ...
8
votes
3answers
4k views

Oauth2 vs APIKey in a server to server communication

A third party service provider is exposing a payment API that we need to integrate on our backend. As transport communication we will consume this API using TLS with Client Certificate and over a MPLS ...
8
votes
3answers
312 views

Reason to use only secrets as API keys?

Many APIs protected with API keys only use the secret key (i.e. a password) without something like an account ID or username. For example Stripe API uses the secret key as the username in Basic Auth, ...
8
votes
1answer
693 views

Automatically determining whether particular product version is vulnerable?

I'm building a system that contains a lot of data about different versions of various networking software (client software, servers, etc) in a human-readable format. Is there an API that I could query ...
8
votes
1answer
2k views

Securing API against DDoS attacks

I have designed a backend service which is only accessible via a custom REST API. As I understand, services such as CloudFlare are designed to protect HTTPS traffic, and do not apply for custom APIs. ...
7
votes
1answer
370 views

Impact of using a NON-SSL/TLS connection for API calls on same server

I have two domains hosted on the same server, Domain A and Domain B, both domains have different IP addresses, assuming IPs 1.1.1.1 for Domain A, and 2.2.2.2 for Domain B. Each domain has a different ...
7
votes
1answer
3k views

How to allow users to connect from multiple devices with refresh tokens?

This question follows my previous one: How to securely keep my users signed in with refresh tokens? What I got from this previous question, is that we need: short-lived access tokens long-lived one-...
7
votes
1answer
2k views

What is the purpose of an API Token and an API Secret?

So if a user authenticates to the site using a username/pw, they get a session token which is passed back to the server to validate who they are. However when you use an API like twitter or 4square, ...
6
votes
2answers
435 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
6
votes
2answers
95 views

Should we prevent access to non-sensitive information?

I'm having a discussion with devs as we build out a web app which involves users, user generated content, an admin area, api and static content. Anyone is able to access the majority of template ...
6
votes
2answers
4k views

How can we protect signup APIs from brute force registration?

This is a general question but its prompted by a fairly open API I have for a file storage service that needs to have its front door better locked down. We have an API like POST '/signup' that just ...
6
votes
1answer
4k views

Why use a proxy to hide OAuth client credentials in password grant calls?

In a November 2014 article by Alex Bilbie, OAuth users were advised against making the client send its credentials (client_id and client_secret) when performing Resource Owner Password grant calls. ...
6
votes
3answers
944 views

Why Youtube, or any other Google services use account binded authorization key plain in the url?

in the past I expirmented with Google available api tools, like the Drive and Youtube api's. The way it works is after you purchase a deveopler account, you are granted to many of Google services ...
6
votes
2answers
5k views

Secure OAuth 2 flow for client-side or mobile app

I'm implementing an API and a client-side web app, and they are supposed to communicate via an API and use OAuth 2 for authentication. I can't get over my confusion on what's the right way to ...
6
votes
1answer
4k views

Simple, Secure PHP API Design

I'm trying to design a secure RESTful API web service with as few moving parts as possible. I have some questions, and want to make sure my design is secure. For the data transmission level of ...
6
votes
1answer
873 views

Simple Authentication Method to Secure REST API

I've been desperately trying to find a simple method of securing my API but still haven't found one that works. Unlike a lot RESTful APIs my API doesn't need user logins, tokens that expire, or other ...
6
votes
1answer
832 views

Securing REST API via Hawk

I'm currently using Hawk as the auth scheme for an API. Basically, the current flow (forced SSL) involves: User types in email/passwd on app App performs 1000 rounds of PBKDF2 using the email as salt,...
5
votes
1answer
20k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: http://www.asp.net/web-api/overview/security/working-with-ssl-in-web-...
5
votes
2answers
4k views

What is the difference between API keys and API tokens usages?

From all the research that I have done, I have found that API keys are less secure than access tokens (under usage of oAuth), and should only be used for monitoring purposes. But from what I ...
5
votes
1answer
124 views

Does returning a 401 error from an API leak information?

I'm developing an API for an application I'm working on and I've come across an interesting question: Imagine an API endpoint like this: GET /customers/123456 which returns a single customer object....
5
votes
1answer
753 views

Why should I hide API keys?

I need to integrate my android app with dropbox, basically all I want is for the user to choose a file from his dropbox and give it to my app. In order to do that I'm using dropboxChooserSDK, and it ...
5
votes
2answers
404 views

Security mechanism differences between Google and Amazon APIs

Does anyone know why Google and Amazon (AWS)'s API have such different ways to deal with security? For example, Google has a simple API key which you can revoke at any time, while Amazon has this ...
5
votes
2answers
2k views

OWASP Secure Headers for Web Services

Is the following headers mandatory for a web service that handles POST requests and return data using SOAP? HTTP Strict Transport Security (HSTS) X-Frame-Options X-XSS-Protection X-Content-Type-...
5
votes
1answer
573 views

Why some applications host the API in a different domain?

I have seen a trend of applications moving their APIs to other domains (from api.application.com to api.applicationapi.com). Two examples: 3.basecampapi.com and api.dropboxapi.com Is there a ...
5
votes
2answers
4k views

Preventing resubmission and replay attack using client nonce in REST API

I have a REST API backend which has HTTPS (and blocked HTTP) and use JWT as the authentication mechanism. Client side is iOS/Android App. I want to add a layer of safeguard on critical API by using ...
5
votes
1answer
2k views

Content-type validation in REST APIs

I'm trying to wrap my head around, why it is advised to validate the content-type, sent by a client to a REST API. OWASP states in their REST Security Cheat Sheet: When POSTing or PUTting new data,...
5
votes
1answer
628 views

API which does not allow to invalidate session on server side - how to make it more secure?

I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like logout which will make the cookie my app is using be invalid from now on. ...
5
votes
1answer
1k views

How to securely store API keys

I need to store API keys for my users. These keys are extremely valuable as they are used to buy and sell things. Some users won't want to give these keys to anyone, and I'm trying to figure out a ...
5
votes
3answers
157 views

Rate Limiting An API

I am busy developing an API for a mobile application, currently one of the endpoints require that the users username and password be POST'ed to it. What I am worried about is someone discovering that ...
5
votes
1answer
156 views

Is it worth verifying the request hostname in API-to-API communications?

When authenticating from a browser application to an API layer, you can verify the request origin for CORS requests. I'm aware that this is primarily to prevent CSRF attacks. It doesn't prevent an ...
5
votes
1answer
2k views

Sending non-expiring access token on each request vs using refresh tokens?

When securing REST APIs for mobile applications, what you often see is the use of refresh tokens. They exist because: Access Tokens have expiration date. We don't want the user to have to enter his ...
4
votes
2answers
3k views

What happens when your secret API key is stolen and used by others?

The use of paid API is increasingly rising each year. For example, IBM, Google and Microsoft are providing paid API such as Text to Speech, Speech to Text and Image to Text and vice versa. I have a ...
4
votes
1answer
5k views

How to protect API Key in Android application

I was working on one Android App which was communicating with RESTFull server. We made an API Key which was inserted in header of GET and POST requests. This API Key was stored in Strings. App is no ...