Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

Filter by
Sorted by
Tagged with
3 votes
1 answer
71 views

REST API behind proxy, is TLS sufficient?

I have the following problem: A service provides a REST API. Different kinds of clients (desktop applications, mobile applications, web applications) connect to this API and send and receive data. In ...
user avatar
0 votes
1 answer
52 views

Why REST APIs that do not use RSA encryption to secure API keys?

After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key. The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
user avatar
2 votes
1 answer
34 views

use md5 hashed guid as app login and REST interface

We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest - api. All communication is over a secured https channel. The REST api is programmed to resist XSS ...
user avatar
  • 127
0 votes
0 answers
21 views

DNS spoofing an API? [duplicate]

Could someone DNS spoof REST API communication between a client device POST to a server URL running a XML-based API on HTTPS? If a man-in-the-middle for client device(s) POSTing to the server on a ...
user avatar
  • 101
0 votes
0 answers
27 views

Security Practices for a React App - Node.js - Notion REST API Pipeline

I've been thinking about security practices for a personal project where I would create content on a Notion account and have a Node.js middleware server that'll act as a REST API that allows anybody ...
user avatar
0 votes
1 answer
34 views

Impact of setting allowUrlEncodedPercent to true in StrictHttpFirewall

I need to implement a public REST API that manipulates usernames. So I have an endpoint that looks like GET http://.../api/users/<username> where username can contain special characters (slashes,...
user avatar
0 votes
0 answers
104 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
user avatar
  • 6,685
0 votes
0 answers
52 views

authentication for SDK requests to a private API

I have an API that responds to requests with a JSON that contains app updates and advertisements. Requests are sent by my SDK that is implemented inside my game. I need authentication because JSON ...
user avatar
  • 101
1 vote
1 answer
173 views

How to implement the CSRF token mechanism for restful APIs?

Considering the following facts, using CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable: storing JWT in local storage(any where other than http-only cookie) ...
user avatar
  • 113
0 votes
0 answers
88 views

Is using a developer key to protect a REST API good practice?

I'd like to implement a RESTful API service over HTTP that developers can call from their server side environments. I intend to use a cryptographically secure pseudo-random number generator (CSPRNG) ...
user avatar
0 votes
1 answer
486 views

CheckMarx SSRF Vulnerability

I have a REST which takes a parameter dataSource as input and myService has follow logic. @RequestMapping(value ="/save", method = RequestMethod.POST) public List<String> find(@...
user avatar
0 votes
1 answer
169 views

Cookies Vs Headers For REST API User Authentication Token

I'm working on a small rest api project with user authentication. But I'm wondering whether I should store the users authentication token in a header or a cookie. The general idea is as follows: User ...
user avatar
  • 3
0 votes
1 answer
66 views

Is it possible to avoid exposing the fact that an e-mail address is used by a web application (API) while still ensuring a decent UX?

One of the raised issues for a Web API is that for an e-mail based authentication (e-mail and password) the Register user method returns something like "the registration e-mail has been sent"...
user avatar
  • 2,183
0 votes
0 answers
99 views

Refresh token rotation or Authorization Code Flow with PKCE

In a new project, we try to clarify how authorization should look like. I've been reading up on this for days, but it's not really clear to me which solution would be the right one to use. Some ...
user avatar
  • 101
0 votes
3 answers
121 views

Security issues of exposing CRUD operations through a single API endpoint?

Imagine an API where all CRUD operations are done through the same POST HTTP Request but with different "action" values from request body. { "action":"[create|read|update|...
user avatar
1 vote
1 answer
246 views

OWASP Pentest - "Sensitive data sent in clear text" [closed]

We have our web app / REST API getting tested by potential customer. In the report they came up with this issue: Sensitive data like user credentials on login page, password reset, change password ...
user avatar
  • 121
0 votes
0 answers
66 views

Do I need to authenticate a user on WhatsApp when using twilio?

We are building an online shop using django. We have developed an API for our application to interact with Twilio. This is so users can buy products on WhatsApp from our application. I want to know ...
user avatar
  • 101
1 vote
0 answers
113 views

Is masking JWT custom claims a good practice?

We use JWT tokens in our Rest API(Bank API) authentication with a normal payload like: { "user_id": "cdda338f-50e2-4e14-9f84-33b8a158db9f", "tenant_id": "...
user avatar
0 votes
0 answers
83 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
user avatar
2 votes
1 answer
208 views

Can one send data securely to a REST API endpoint

Say I have an endpoint to create a username: https://example.com/api/create_user/foo/1234/ or https://example.com/api/create_user/?name=foo&token=1234 Where username = foo and the api token is ...
user avatar
1 vote
0 answers
208 views

Basic authentication after mTLS?

I work for a software company and I'm currently doing research for an enhancement request. Essentially we have a application client which talks to a rest end point which is authenticated using basic ...
user avatar
0 votes
0 answers
81 views

REST App with Hydra

I tried making a Hydra attack against a rest application locally. However I find it difficult adding the headers (especially the cookie) to the command. The request that shows on browser is as it ...
user avatar
2 votes
2 answers
138 views

Access Control for REST APIs - OWASP recommendation

OWASP states: Non-public REST services must perform access control at each API endpoint. Web services in monolithic applications implement this by means of user authentication, authorisation logic ...
user avatar
0 votes
0 answers
141 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
user avatar
0 votes
1 answer
447 views

REST API is protected by HMAC based authentication. What does including URL path in the message protect from?

I have came across a REST API for some commercial software, that checks authentication by requiring HMAC on concatenation of http_method (GET, PUT, etc) timestamp payload (body of a POST / PUT ...
user avatar
0 votes
0 answers
721 views

JWT token. Send in a cookie or Auth header depending on Rest vs MVC?

Reading around I gather that for a Restful API since you don't use cookies,then you send the token in the Auth header.Correct so far? When on a traditional MVC app ,do you send the token inside a ...
user avatar
  • 2,099
0 votes
1 answer
155 views

Replace hashed password by public key generated from password

I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
user avatar
2 votes
1 answer
135 views

Authentication for website and mobile app

This doing a Spring Boot application (Rest API, JPA, etc) uses (via Rest) from a website (Angular) and a mobile app (Android). The user using the mobile app (in the future) will be able to ...
user avatar
0 votes
2 answers
142 views

Reject requests from our tampered android apps

I'm working on an Android application with few millions of users. The app has some financial|payment features. We have some public APIs and some authenticated ones (OAuth2). As a part of enhancing our ...
user avatar
2 votes
3 answers
192 views

How can I prevent API bot automation by a legitimate user?

My web application is a long sequence of games, which submit progress results back to the server via a web API. These progress messages are how we know how many points the user has earned. The points ...
user avatar
2 votes
2 answers
555 views

How could a server to server rest api communication be more secure, by using OAuth 2?

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
user avatar
  • 183
0 votes
2 answers
196 views

API key safety in front end app running in localhost

I have been working on a front end (React) app that sends REST requests to an API end point. I am aware that sensitive items such as API keys should not be stored in front end frameworks (like React, ...
user avatar
  • 145
0 votes
1 answer
170 views

RestApi Libsodium SealedBox end-to-end request encryption scheme

I am making an API that uses the following steps for encryption. All of this is implemented using libsodium. First of all the client has to make an initial request to the server for getting his public ...
user avatar
0 votes
1 answer
83 views

Are there any identity providers which support securing RESTful interfaces using digital signature?

I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract: When signing, the sender uses ...
user avatar
2 votes
1 answer
443 views

What else can be used instead of an API Key to protect resources in a REST API as is implied by OWASP?

I was reading the OWASP Cheat Sheet Series, specifically their cheat sheet for REST Security and one of the points they had under the section for API Keys was: Do not rely exclusively on API keys to ...
user avatar
  • 217
1 vote
1 answer
605 views

Secure REST API for mobile and web application usage

I have been reading about authentication and authorization for the past few days and I still have not figured out what would be a reasonable way to deal with this for both mobile and web applications. ...
user avatar
  • 111
0 votes
1 answer
137 views

Secure a REST API

I want to build a REST API where applications can authenticate using an OAuth2 Bearer Token, so they get access only to resources related to one user or they can access by itself accessing resources ...
user avatar
28 votes
6 answers
6k views

Is splitting a REST API server from a Web server considered a security threat?

I am participating in a project that involves a JavaScript SPA that provides a service and is intended to interact via REST APIs with one of our servers. Initially, I proposed to work on the two ...
user avatar
  • 391
1 vote
2 answers
2k views

How to not use database identifiers in a URL in the context of a REST API

During my IT school years, I was told that including rows identifiers from a database in the resource URL, in the context of a REST API, is a bad practice. To my understanding, the rationale behind ...
user avatar
0 votes
1 answer
302 views

B2B authentication best practices

I'm in the process of developing a B2B (business-to-business) application. I've implemented JWT auth, and it is working as expected. Right now the authentication functions as if it were a B2C (...
user avatar
  • 101
1 vote
2 answers
2k views

Authorization Header in dev tools

My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call. This will expose the ...
user avatar
  • 265
1 vote
3 answers
711 views

Authentication & Authorization via md5(userid + secret + endpoint + payload)?

I am currently developing against a RESTful API that seemingly has a rather weird auth flow. I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID). Now, ...
user avatar
0 votes
0 answers
118 views

APIs Security for publicly exposed APis for Website/App

We have a website using PWA Client calls / Mobile APP, all using the same APIs. We have APIs Exposed to Public. Currently, our APIs are not secure meaning that anyone can check APIs signature via ...
user avatar
-2 votes
1 answer
141 views

Securing a read-only REST service for mobile access

I am writing a mobile app that uses a read only REST service that sits behind our company firewall. The actual data supplied by the REST service is not private but I am concerned with a hacker using ...
user avatar
0 votes
2 answers
780 views

How to prevent CSRF attacks on a REST API when using Windows Authentication

I have a Angular web app that interacts with a REST-API. Requests are authenticated with a JWT Bearer token. I now want to add support for Windows-Authentication. My current plan is to add a POST-...
user avatar
22 votes
8 answers
7k views

Protect API from being tampered?

I'm building an API with websocket that serializes data through JSON. The App itself is a chat application. I came up with the following structure to send my data: {date: '2020-05-31', time: '14:28:...
user avatar
  • 379
6 votes
3 answers
3k views

Should we encrypt all REST API calls from a mobile device?

I have a mobile application and the backend is hosted on a cloud provider. I would like to ask for feedback on encrypting all REST API calls that will be used to communicate with the server, if we ...
user avatar
  • 163
1 vote
0 answers
581 views

REST API scanning using WebInspect

I am trying to scan our internal site's REST APIs using WebInspect. As the site does not yet follow the Open API Standards or use the Swagger tool, it does not have a .json file that contains the API ...
user avatar
  • 177
7 votes
1 answer
551 views

Does PUT or DELETE offer any security advantage over GET or POST?

I have a REST API and I want to handle all HTTP requests via POST. Is there any security issue in using just POST to perform all CRUD operations requested by a user, which sends JSON specifying the ...
user avatar
  • 193
0 votes
1 answer
713 views

Private REST API accessible only via SSH?

We are trying to bulletproof our server from DDoS / MIM etc. Use case: Clients (<5 in number) want to get some data from remote server Client open SSH connection to server, they can now access ...
user avatar
  • 101

1
2 3 4 5
8