Questions tagged [api]

Application Programming Interface; a set of routines, protocols, tools or endpoints used in software development.

Filter by
Sorted by
Tagged with
1 vote
3 answers
611 views

API Method Parameter Enumeration via Web Browser

I am obligated by contract to prevent enumeration of an API method's parameters but cannot achieve it. When I send a blank request to the API server in a web browser, the server responds with the ...
8 votes
1 answer
817 views

Automatically determining whether particular product version is vulnerable?

I'm building a system that contains a lot of data about different versions of various networking software (client software, servers, etc) in a human-readable format. Is there an API that I could query ...
  • 6,524
1 vote
1 answer
399 views

Storing encrypted data readable only by user but created by server

Context I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in ...
  • 113
3 votes
1 answer
114 views

SSL between websites on the same server

I have deployment that includes a public asp.net website and an internal webAPI both installed on the same machine. The webAPI will only communicate with the website. For example, it will not be ...
  • 181
0 votes
0 answers
290 views

Youtube API security

I was playing about with youtube's API yesterday and did some research about its security. Now.. I have a website which I would like to apply Youtube API for it and I just wonder how NON-secure is to ...
1 vote
3 answers
2k views

Storing API tokens safely on Android to identify developer

We're building an Android library for our Rest APIs that app developers will access with a unique token. Since it's a paid service, and it's a per-request or per-install pricing model, how do we ...
  • 113
1 vote
1 answer
1k views

How to store a token of a restful API?

It's a basic question, but I see in a lot of tutorials of authentication in restful webservices that some user goes to a website and register yourself with an ID and a password, after this ...
  • 125
6 votes
2 answers
529 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
0 votes
0 answers
3k views

Secure REST API using Public/Private keys?

I was having a conversation with some programmer friends about securing an API without server modification. Only SFTP access to the filesystem is allowed and OpenSSL extension is installed, the admin ...
2 votes
2 answers
865 views

REST Services: Limiting the concurrency of a login endpoint

Scenario: A botnet is recruited to try to authenticate against a website or service with each bot trying infrequently using a common password and a list of 'real' email addresses, avoiding the ...
9 votes
2 answers
436 views

Mobile API Authentication

I'm trying to design an Android Analytic service where every user's application who register in this service needs to download our SDK. The SDK itself need to communicate with our API server. The ...
  • 199
2 votes
1 answer
715 views

What reasons are there to not just send the API key as an HTTP header over HTTPS?

I've been recently struggling to use Microsoft's Azure platform (which has been an unfathomable pain in the ass). One early thing I noted was how the authentication was unexpectedly more difficult ...
  • 411
13 votes
2 answers
21k views

JWT token login and logout

Hi I am creating mobile native application that uses REST API endpoints to communicate with server side. I have had previous experience developing native clients, but I have simple token (random ...
  • 131
10 votes
1 answer
29k views

How client certificate works for authentication (in Web API)

I have been working on this scenario for a week. I have implemented the code to authenticate client certificate using this link: http://www.asp.net/web-api/overview/security/working-with-ssl-in-web-...
  • 211
19 votes
1 answer
42k views

Where to store access and refresh tokens on ASP.NET client web app - calling a REST API

I've made a Web API in ASP.NET that acts as the entry point into a SQL Server database for report data. This service has a "token" endpoint that authenticates a user via ASP Identity and return a 20-...
3 votes
1 answer
1k views

Encrypt/sign a client-to-API request?

We are building a JSON API on top of our Ruby on Rails Web application, using JSONAPI::Resources to expose endpoints and Doorkeeper to handle user authentication. Most of our API endpoints will be ...
0 votes
1 answer
94 views

How do API's authenticate a user?

I've read many documents about API's but they don't seem to mention API's for private accounts instead of publicly accessible information. How does an API work to request private account data? How ...
  • 1
0 votes
3 answers
3k views

Securing REST API with HMAC and basic auth

I was wondering if giving users choice of a method for securing their access to API would be a good idea. Background: We are creating and deploying applications for our customers, which help them do ...
3 votes
1 answer
174 views

Should I make my api calls to update users contain a password or hashed auth key?

So Im creating an API for an app that in the backend involves updating users, deleting users, and some other user related stuff. Im using the slim framework and I was wondering when the user wants to ...
  • 131
19 votes
2 answers
27k views

HTTPS POST request header versus request body

Is there any security difference between placing sensitive data, such as an API key in a POST request header versus the POST request body assuming the API server is HTTPS-only? While you frequently ...
  • 293
6 votes
1 answer
4k views

Why use a proxy to hide OAuth client credentials in password grant calls?

In a November 2014 article by Alex Bilbie, OAuth users were advised against making the client send its credentials (client_id and client_secret) when performing Resource Owner Password grant calls. ...
  • 163
0 votes
1 answer
760 views

Is sharing a CSRF token between Rails apps secure?

We use an nginx reverse proxy to host two Rails apps under the same domain (one /path leads to another 'secondary' app). The 'secondary' app that lives under a path consumes REST APIs from the 'main' ...
  • 103
-1 votes
2 answers
288 views

Validate API caller domain (or any other related solution)

I am quite new to creating services using PHP-cURL. I want to offer some data/service to only registered domains. I know that I can identify these domains using app ID and API keys for data encryption....
3 votes
2 answers
489 views

How secure is loging into internet banking via an https library?

My bank does not have an API so I want my server to log in and check incoming payments to notify me if a client has paid or not. I would like the server to log in and scrape using Beautifulsoup and ...
2 votes
1 answer
4k views

Token based approach to authentication over SSL Rest API - refresh tokens

I'm quite a newbie at security. I'm developing an android app with a token based approach to authentication. I'm not using Oauth as the OAuth 2.0 is not an authentication protocol but rather used to ...
  • 131
1 vote
1 answer
263 views

What security practices should I keep in mind during development? [closed]

I am beginning to develop apps for Android and iOS that make API calls to a PHP web application that I will be developing. Users will be required to sign up with a username, password, and (optional) ...
  • 153
5 votes
1 answer
1k views

Key derivation inside secure container of HSM

I have to implement custom key derivation function which basically works as follows: I have encryption key K in secure container of HSM. K can't be exported and the only way how to use it is through ...
  • 1,099
6 votes
1 answer
1k views

Securing REST API via Hawk

I'm currently using Hawk as the auth scheme for an API. Basically, the current flow (forced SSL) involves: User types in email/passwd on app App performs 1000 rounds of PBKDF2 using the email as salt,...
  • 111
5 votes
1 answer
937 views

API which does not allow to invalidate session on server side - how to make it more secure?

I'm writing an app around a REST API which does not allow the server to invalidate a session - i.e. there's no endpoint like logout which will make the cookie my app is using be invalid from now on. ...
3 votes
1 answer
1k views

Securing REST API without sending or storing clear credentials

We are currently designing a REST API, and thinking about securing it. Going through a lot of documentation, it has become clear that 2 options are available. HMAC Authentication By hashing with ...
  • 173
1 vote
0 answers
201 views

Is it necessary to add CSRF tokens for REST API? [duplicate]

I have a few REST APIs for an iPhone app. It has a login and session management functionality. Currently the session has been tracked by a token set during login. Are REST services affected by CSRF ...
4 votes
3 answers
10k views

How to make sure an API request is coming from a specific domain?

I'm opening up some API access to my site and my users are required to specify from which of their websites, such as example.com, they will make the API requests. I'm wondering if there's any way to ...
  • 749

1
6 7 8 9
10