Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Filter by
Sorted by
Tagged with
0 votes
0 answers
21 views

Why "application/x-www-form-urlencoded" is normally used for login but not for registration?

I may be wrong, but for security reasons, in REST APIs the login credentials are always sent with the content type application/x-www-form-urlencoded. But I haven't seen the same with user registration;...
0 votes
0 answers
14 views

Presenting users their API Keys on frontend

I'm not talking about showing them a popup upon api key generation, where the user is specifically warned about the fact that This is the only time you will see it. Make sure to save this to a safe ...
  • 1
4 votes
0 answers
38 views

How can this form boundary be used to detect a different device?

I am trying to talk with an API endpoint usually used by a secure app. I have managed to defeat the signature by extraction the private key from the app. All headers, bearer token and device token ...
's user avatar
0 votes
0 answers
55 views

Brute force prevention and alike with stateless API architecture

What are the patterns (best practices, whatever) to prevent brute force (and features alike) in stateless API architectures that keep the system stateless? Couldn't find anything regarding this topic. ...
0 votes
0 answers
51 views

OpenID Connect for authenticating a web-api

I want to accomplish the following: Having a web application or mobile app authenticating users using openid connect. Having a REST Api authenticated using openid connect using the same user as for ...
0 votes
0 answers
26 views

JavaScript API calls in Browser security

We want to develop a JavaScript application (with Angular) which will communicate with various other systems via API calls. For example, a checkout page where all entered information should be sent to ...
1 vote
1 answer
99 views

Do sites like reddit and Quora expose their Google API client keys to the public?

On Quora, when I want to sign in using Google, I am redirected to this URL, which has a parameter client_id=917071888555.apps.googleusercontent.com. Similarly, reddit takes me here, which has ...
0 votes
0 answers
25 views

Securing many infrastructure servers sitting behind a centralised web server

Problem We have 100+ servers that we are looking to manage through a REST API. The REST API for each of these servers will only ever be consumed from our Centralised Management Server (CMS). Therefore,...
0 votes
1 answer
126 views

Using two different random numbers instead of RSA Keys

Binance public API supports access to specific operations with RSA key pair. Firstly customer generates an RSA key pair. The customer uses the secret key to hash(SHA256) the query string parameters ...
0 votes
1 answer
69 views

API Client Secrets are Being Logged in Plaintext (PowerShell Logs)

I'm currently implementing a PowerShell script to call the Sophos API (https://developer.sophos.com/intro). Write-Output "`nEnter the Sophos API key / client secret." $ClientSecret = Read-...
0 votes
1 answer
64 views

refresh token without client_id and client_secret

I was reading the OAuth protocol docs https://datatracker.ietf.org/doc/html/rfc6749#section-6 where it implies that you don't need a client_id and client_secret to refresh an access token, just a ...
  • 113
1 vote
0 answers
73 views

Any Windows/NTFS trick to ignore/cancel out a file extension from a path?

I am pentesting an application. The application exposes a SOAP API, which I have access to, and internally that API makes the following call: File.Open("C:\Resources\"+resName+".res&...
1 vote
1 answer
34 views

How do you call REST API resource unintentional field modifying?

Today I stumbled on a potential vulnerability where I could change my profile rank. I'm pretty sure that should not be allowed for regular users. Let's say, for example; I got an account profile ...
  • 11
0 votes
1 answer
42 views

Should API keys, even for free services, be visible in a page's source?

I sometimes see API keys in page sources, such as the following: <span class="nf">init</span><span class="p">(</span><span class="nv">...
0 votes
0 answers
31 views

What are some common vulnerabilities in APIs?

While doing web application security in startup companies, I am exposed to some backend APIs that integrate with the client web app, but testing APIs is a completely different procedure that I do not ...
  • 1
0 votes
1 answer
46 views

How to mitigate risk of exploiting open POST endpoints?

I'd like to ask for advice reg. protecting the state-altering HTTP API endpoints of the API that I'm owning (POST etc.). I'm owning a web application that exposes some HTTP endpoints to the world. ...
3 votes
1 answer
82 views

REST API behind proxy, is TLS sufficient?

I have the following problem: A service provides a REST API. Different kinds of clients (desktop applications, mobile applications, web applications) connect to this API and send and receive data. In ...
0 votes
0 answers
29 views

When in a container do TCP API calls need TLS? [duplicate]

I have an application I'm building where all components will be contained inside a single container. I'm wondering about API calls within the container between the components, i.e using localhost, ...
0 votes
1 answer
54 views

Creating secure website-based login for a desktop app

This question relates to this post I made on StackOverflow recently, which I'll recap here briefly. I have a desktop app that I would like to authenticate through a website, using the process outlined ...
  • 103
0 votes
1 answer
154 views

Why REST APIs that do not use RSA encryption to secure API keys?

After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key. The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
0 votes
1 answer
54 views

Is api encryption key vault services really secure?

I am looking for a secure (and as easy as possible) way to store my encryption key. I have been looking at some services that will hold the key for you and then you can retrieve it with an api. The ...
0 votes
0 answers
58 views

Rails API Session Security and CSRF

I am doing an api with Rails(api-only). Security is so importand for me. I got 2 question. 1-) I am keeping user's id in session[:authID], is it safe to use like this? 2-) Do i need CSRF protection ...
  • 1
0 votes
2 answers
60 views

How to secure an enpoint to prevent programatic calls from the client?

We have a game that is built on the client side. People who get past a certain level are eligible to enter a raffle. This is done by sending a request to an endpoint from the client once they get past ...
  • 1
0 votes
2 answers
137 views

Digital signature for API authentication feasible?

Could it be practical to authenticate API request through digital signature (based on headers and message body)? This would be asymmetric instead of something like HMAC which is not a signature. ...
  • 101
15 votes
6 answers
6k views

Preventing users from tampering with input

Let's say that I have a single-page web app written in JavaScript and a server-side API, both changeable by me. The app calculates some values based on user input and POSTs these to the API. The ...
  • 315
0 votes
0 answers
37 views

Saving sensitive data unencrypted

Problem I am currently working on a web project which makes certain API requests with the user's data. I am using the Moodle API (Moodle is a platform for school related stuff) and the WebUntis API (...
  • 1
0 votes
1 answer
96 views

Can I safely expose a read-only RESTful API with no key or token?

As the title suggests, I would like to expose a couple of read-only endpoints without requiring a key or token. The endpoints will allow the user to request their data for the purposes of displaying ...
  • 1
9 votes
4 answers
3k views

Is a backend API server vulnerable to CSRF?

We recently ran a Veracode SAST scan on our application and discovered that it has a CSRF. However, I wanted to check whether this is really true or it's just a false positive. Our application is a ...
  • 193
0 votes
0 answers
16 views

How to verify the reliability of the request (impersonation)?

I'm using JWT for authentication and I use HTTPS. For every request that is made to the server has a header with bearer Token which has an access token. To retrieve my user info Page I have coded my ...
2 votes
0 answers
86 views

Where should rate limit be applied?

I would like to hear the best recommendations about where to apply rate limit on APIs. We use k8s (microservices) with an ingress controller that is behind an API gateway, that is behind a firewall. ...
0 votes
1 answer
356 views

What would be the best way to mitigate Azure Application Gateway WAF False Positive?

We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
0 votes
2 answers
156 views

HTTP with encrypted message vs HTTPS

A bit of background: I am a web developer and sometimes i integrate some form of external API in my web applications. It's the second time already that i find something strange: some APIs instead of ...
  • 3
1 vote
0 answers
52 views

Using the same JWT token for the web and public API

Lets say my web client gets a JWT token for authentication so it can make request to the API server. Now, I'd like to create a public API (which will basically be the same as the api for the web ...
0 votes
0 answers
46 views

Blacklist of hostname/IP so user cannot access my server private network?

My Web API acts as a proxy for users to connect to another server: User ➡️ My Server ➡️ Any Internet Server. They do that by specify a hostname ftp.example.com or 111.111.111.111. I do not want them ...
  • 109
0 votes
0 answers
55 views

authentication for SDK requests to a private API

I have an API that responds to requests with a JSON that contains app updates and advertisements. Requests are sent by my SDK that is implemented inside my game. I need authentication because JSON ...
  • 101
0 votes
0 answers
66 views

In addition to username and password, can client ID and secret be considered as a multi-factor authentication?

Two-factor or multi-factor authentication is based on three possible forms of authentication: Something you know Something you have Something you are Since username and password are considered as &...
2 votes
1 answer
134 views

API Sql Injection Need help

I need some help with sqli in API. Webserver IIS 8.5 GET request looks like this ... https://example.com/api/Search?q=Landing Response look like this HTTP/1.1 200 OK ... [{"pageId":1,"...
  • 21
5 votes
4 answers
594 views

Do Key-Derivation Functions pose a Denial-of-Service Threat for APIs?

Imagine a simple API, which offers an endpoint POST /account/authenticate, which takes a username and password, then returns a JWT on success and an error on failure. In the backend, the endpoint uses ...
's user avatar
-1 votes
1 answer
519 views

How to secure backend API access?

In the good old days, you made server-side websites using PHP or something like that, now we have modern web apps divided into front-end and back-end (usually API Rest), you can't rely on CORS because ...
  • 143
0 votes
1 answer
157 views

Origin header reflected in ACAO header with ACAC set to true on an API

While reviewing an SPA web application the backend API server was reflecting the Origin header from a credentialed request in the Access-Control-Allow-Origin header of the response with Access-Control-...
0 votes
0 answers
72 views

How to secure an API end point when using javascipt

I'm struggling to understand how one can secure an API endpoint using JavaScript. I want to create a copy and paste-able snippet of Javascript that a user can paste in their site. And on page load/s ...
0 votes
1 answer
101 views

Block API calls from app to stop DDoS attacks

Recently we had a discussion about the security of a mobile app we are working on. The security team requested that if a user is blocked (due to many failed login attempts), then the back-end should ...
  • 1
0 votes
2 answers
89 views

PCI : scope debate : API consumers

The Problem I have two systems. System A - E-commerce application that handles (does not store cc) customer credit data during purchase. System B - Invoicing system for these transactions (does store ...
  • 103
0 votes
1 answer
73 views

Sqlmapapi configuring task options

I'm trying to make scans using Sqlmapapi. I have added a new task, and when I call /option/$taskId/list in response, I receive JSON output with options that can be set. I could not find any ...
0 votes
1 answer
237 views

ASP.NET Core - are files put in the Shared folder under Pages (where the Razor pages reside) publicly accessible?

Are files put into the Pages/Shared folder public to the whole WWW if the website is hosted publicly? I am asking since I want to implement a partial view load thru a controller and want to know ...
  • 212
0 votes
1 answer
157 views

Is malware a threat vector for REST APIs?

Let's assume we have REST API in which you accept GET and POST HTTP requests without the ability to execute files. Is it possible to execute malware in this scenario? Would there be any justifiable ...
0 votes
3 answers
133 views

Security issues of exposing CRUD operations through a single API endpoint?

Imagine an API where all CRUD operations are done through the same POST HTTP Request but with different "action" values from request body. { "action":"[create|read|update|...
3 votes
2 answers
4k views

Is it possible to set an HttpOnly Cookie from one domain to another subdomain

I am pretty sure that the answer to my question is no, but I have been have a hard time finding an answer through official documentation or other posts here. Here is simple use case for some context: ...
1 vote
1 answer
549 views

THC Hydra sends GET request without parameter before actual request with parameter which causes authentication problems

I am using THC Hydra (v9.0) on GNU/Linux to pentest my private API. The GET route in question requires a key as GET parameter which returns an auth token if the correct key was submitted else "...
  • 11
1 vote
2 answers
163 views

How is "Smart Contract" security different?

I am learning smart contract programming on Ethereum (using Solidity) and realizing that security is highly important here. Why? Because of 2 reasons: they deal with high-stake financial transactions, ...
  • 221

1
2 3 4 5
10