Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

97 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4 votes
0 answers
38 views

How can this form boundary be used to detect a different device?

I am trying to talk with an API endpoint usually used by a secure app. I have managed to defeat the signature by extraction the private key from the app. All headers, bearer token and device token ...
user avatar
4 votes
1 answer
746 views

How to securely store 3rd party API keys directly on web server

I'm building a private web app that I plan to use between myself and a few select friends. Each of us have API keys for a 3rd party service that my web app needs to access so it can call the 3rd party ...
3 votes
0 answers
132 views

Prevent developer/owner from seeing user data with insecure API

I am building a chatbot for my university in GroupMe, which very popular there. The bot will, for example, allow users to send messages to their chat groups like /menus (assuming that "/" is the ...
2 votes
0 answers
86 views

Where should rate limit be applied?

I would like to hear the best recommendations about where to apply rate limit on APIs. We use k8s (microservices) with an ingress controller that is behind an API gateway, that is behind a firewall. ...
2 votes
1 answer
134 views

API Sql Injection Need help

I need some help with sqli in API. Webserver IIS 8.5 GET request looks like this ... https://example.com/api/Search?q=Landing Response look like this HTTP/1.1 200 OK ... [{"pageId":1,"...
  • 21
2 votes
0 answers
100 views

IoT Device Authentication

I am working on an IoT device and companion app to control features on the device. I'm using an ESP32 MCU - http://esp32.net/ I've implemented a JSON REST API on HTTPS over TLS 1.2 with a self signed ...
2 votes
0 answers
335 views

Alternatives to OAuth 2 for first-party native applications

I am currently thinking about alternative ways for my native iOS Application (written in Swift) to receive access- & refresh-tokens. As of now, user sessions are established using revokable JWTs, ...
2 votes
0 answers
372 views

API protection - JWT vs HMAC signing vs OAuth

Lets say you are designing a new API. The consumer of your API is a mobile app that periodically sends requests in the background, but you expect other consumers as well, such as web apps or servers. ...
  • 121
2 votes
3 answers
247 views

How to limit web API microservice communication to specific list of machines?

I have an PHP API that I want to be consumed only by one static website. However the HTTP is not secure as from what I suspect any header can be spoofed (IP - I may be wrong here, domain name, and so ...
2 votes
0 answers
199 views

Disable Google API key without access to google account

I was trying the new google api - I created anonymous account - added there my debit card, set up the API key for google maps. Tried API and pushed my API key to shared repository (yes I know - my ...
2 votes
0 answers
1k views

How to secure an API key from client side?

I'm having an issue and I'm pretty sure I'm not the first on that. I'm hoping to have a few great ways, hopefully bulletproof, to avoid any issues, so here it is. I provide an API that converts HTML ...
  • 2,649
2 votes
0 answers
165 views

How to make sure your API key cannot just be copied and used

One thing I often struggle with when developing my API's is authentication. I didn't have much trouble with this when I was making them for just a single website and was able to implement the ...
2 votes
0 answers
102 views

Issuing Personal Access Tokens for my APIs

I have an intranet site, hosted locally within my organisation. The same site also exposes some data through various web services. It's written using ASP.NET MVC 5 and WebAPI 2. At the moment users ...
2 votes
0 answers
844 views

Web API authentication with Kerberos

We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via ...
  • 121
2 votes
0 answers
98 views

How should I authenticate a third party's users on my platform?

I'm having trouble finding implementation ideas / guidance / examples for an authentication system that has the following properties: Allows a third party to carry out actions on our platform on ...
2 votes
0 answers
473 views

Token based authentication: Why invalidate the token after each request?

I use the gem devise_token_auth while developing an API for a mobile app. Authors claim that: Tokens should be invalidated after each request to the API. This behavior is enabled by default. Can ...
  • 131
1 vote
0 answers
30 views

Why "application/x-www-form-urlencoded" is normally used for login but not for registration?

I may be wrong, but for security reasons, in REST APIs the login credentials are always sent with the content type application/x-www-form-urlencoded. But I haven't seen the same with user registration;...
1 vote
0 answers
20 views

Presenting users their API Keys on frontend

I'm not talking about showing them a popup upon api key generation, where the user is specifically warned about the fact that This is the only time you will see it. Make sure to save this to a safe ...
  • 11
1 vote
1 answer
74 views

API Client Secrets are Being Logged in Plaintext (PowerShell Logs)

I'm currently implementing a PowerShell script to call the Sophos API (https://developer.sophos.com/intro). Write-Output "`nEnter the Sophos API key / client secret." $ClientSecret = Read-...
1 vote
0 answers
74 views

Any Windows/NTFS trick to ignore/cancel out a file extension from a path?

I am pentesting an application. The application exposes a SOAP API, which I have access to, and internally that API makes the following call: File.Open("C:\Resources\"+resName+".res&...
1 vote
0 answers
53 views

Using the same JWT token for the web and public API

Lets say my web client gets a JWT token for authentication so it can make request to the API server. Now, I'd like to create a public API (which will basically be the same as the api for the web ...
1 vote
0 answers
138 views

Where should I store an OAuth refresh token for a third party?

I am connecting to a third party which authenticates with OAuth2. Once the user has logged in, I want to store the access & refresh tokens for the user. Which is more secure & proper - to save ...
  • 111
1 vote
0 answers
127 views

Security of apps based on Telegram api?

I am using a telegram api based app named "TurboTel Pro". I am happy with its different look and settings but I am concerned about the data it would take of me. Can someone tell me what data ...
  • 11
1 vote
3 answers
300 views

Is OAuth more secure compared to API Keys

I have worked on many API integrations scenarios and I used 2 approaches to authenticate the API calls: Using API Keys For example inside Hubspot integration I use this web call to get all the ...
  • 131
1 vote
0 answers
213 views

API keys or Client Credentials flow? Good practice to control application access to a deployed web component

Company A developed a widget (Web Component) deployed on several clients/partners. Only clients/partners must be authorized to use the widget. No need to distinguish between each end users (clients' ...
  • 421
1 vote
0 answers
212 views

Securing API keys for accessing Google APIs via Front End (UI)

This question is about how to secure API keys. Not sure if this is in the same category as Key management for Cryptography and should follow the same rules. See details below. We currently have hybrid ...
1 vote
1 answer
199 views

Based on these HTTPS requests what type of attack is this?

I'm seeing over 1000 attempts to hit my API endpoints with many 500 responses. It seems clear that the would-be attacker is attempting to poke around the APIs, but it isn't clear to me what type of ...
1 vote
0 answers
574 views

Best Practices to Store Sensitive Information in Desktop Application (Electron)

I'm working in a desktop application using Electron.js with React.js and I have to store some sensitive information like API keys and database credentials. So I started digging and decided to encrypt ...
1 vote
1 answer
136 views

API's Security for API which are opened to Non-Logged in Users

We have a website and for which we have backend APIs. Now the issue is majority of our APIs are opened for non-logged in user(Functional Requirement). Now what we want is to secure those APIs in terms ...
1 vote
0 answers
518 views

A mesh of Cookie in Header & HttpOnly token - secure "enough"?

This is another attempt of mine to make sense of securing my web-app, which is built with two frameworks: Django REST API - serves as the backend. It generates both a token upon correct login, and a ...
  • 135
1 vote
0 answers
77 views

Generate new AccessToken each time user update his Information

im building a PWA app , where i implemented jwt token to auth users. i have 2 main architecture problems ,but let me introduce you what im building . i'm Building application that is all about dog ...
1 vote
1 answer
181 views

What is the recommended way to generate API tokens using Laravel framework?

I'm a newbie in terms of security, but I need a suggestion to make sure the connection between an API and mobile apps is secure. I'm currently using the Laravel framework. Based on its documentation ...
1 vote
2 answers
276 views

I am signing (HMAC) outgoing webhooks to allow users to verify their source, should I also sign outgoing responses?

To allow api users to verify the authenticity of outgoing webhooks, I am using a similar model to slack: Concatenate timestamp and body, HMAC with pre-shared key, add timestamp and HMAC digest to ...
  • 185
1 vote
0 answers
226 views

How to handle application/jsonp response

I am testing a Web Application and i have found a endpoint which is returning some data in json the endpoint is this. /api/vtexid/pub/authenticated/user Now i was testing to find out that if this ...
1 vote
0 answers
113 views

Is it possible to get hacked by a redirection placed inside a Facebook Graph URL?

Basically, I have a webapp which needs to check the validity of the user of an Android app. After completing the basic login flow with Facebook in the Android app, a Facebook access token is sent to ...
  • 111
1 vote
1 answer
134 views

What is the way to know that the endpoint is down if there is an L4 / L7 balancer?

I'm writing an API-fuzzer and I want to detect if a sequence cause falling down of an endpoint of some service. Of course I can get 500 response code, but it's may be called from code of an endpoint. ...
1 vote
0 answers
82 views

Integrating web applications into our payment API. How to ensure the integrity of the payment process?

We will be creating a brand new application soon that handles online payments for our firm. We now have several different web applications (in different technologies) running that will all be ...
1 vote
0 answers
207 views

Security aspect in the API gateway area

I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level. Scanning REST APIs (see http://docs.w3af....
  • 131
1 vote
0 answers
149 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
1 vote
0 answers
95 views

Public report/telemetry API

I want to implement a telemetry data sender into my electron app. The API which I want to connect to is public. So any crash reports or any other data from the user is sent to it. The problem is how ...
  • 11
1 vote
0 answers
98 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
  • 111
1 vote
0 answers
189 views

Payment gateway API authentication

I've been tasked with building an API that interacts with a couple of payment gateways to create payments. The API has accounts with multiple users and the accounts have payments associated with them....
  • 11
1 vote
0 answers
283 views

Is having multiple access tokens valid at the same time a security risk?

I run an API that allows multiple access tokens (JWT) to be valid for the same account, in order to allow users to sign into the web application and mobile app at the same time. Is this a potential ...
1 vote
0 answers
145 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
  • 111
1 vote
0 answers
73 views

Is it safe for a service to share memory addresses with remote clients?

Supposing a remote service has the following data structures (using C++ as an example): struct Item { std::string name; struct {} whatever_else; }; std::map <std::string, Item *> ...
  • 305
1 vote
0 answers
90 views

Nested API security

What are best practices for securing nested APIs? Here is an example: User browser (Authenticated already) -> REST API A -> REST API B (internal and may or may not be exposed to internet) Typically,...
1 vote
0 answers
129 views

Automatic Paypal payment through API

I am building a game similar to HQ trivia, that when someone gives all the correct answers at the end of the game he or she gets money sent to their Paypal account, my concern is obviously security. ...
  • 111
1 vote
0 answers
137 views

Security of AWS Lambda Communicating to Non-HTTPS API

Wondering what attacks might look like in the following scenario. I have a web service that pings an AWS lambda (behind API gateway), which makes a couple of transactions (sends email, adds to ...
  • 79
1 vote
0 answers
670 views

Sending a POST request with directory traversal attack

I'm trying to fuzz an embedded web server. The problem is that the API requests require a user be logged in by sending a POST request with the username and password. Without the POST request the ...
1 vote
0 answers
137 views

How to secure API from spams & crawling

I am working on mobile app and its API which uses a private token for every user for authentication. I want to make sure that no one will misuse the API to crawl my data or to spam my database. Even ...