Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

Filter by
Sorted by
Tagged with
28
votes
6answers
6k views

Is splitting a REST API server from a Web server considered a security threat?

I am participating in a project that involves a JavaScript SPA that provides a service and is intended to interact via REST APIs with one of our servers. Initially, I proposed to work on the two ...
1
vote
2answers
72 views

How to not use database identifiers in a URL in the context of a REST API

During my IT school years, I was told that including rows identifiers from a database in the resource URL, in the context of a REST API, is a bad practice. To my understanding, the rationale behind ...
0
votes
1answer
65 views

B2B authentication best practices

I'm in the process of developing a B2B (business-to-business) application. I've implemented JWT auth, and it is working as expected. Right now the authentication functions as if it were a B2C (...
0
votes
0answers
25 views

API GET Request resulted in a Bitdefender thread alert

This is a very strange occurrence and could be a false alarm. I am testing an API from an advertisement network for my WPF desktop app. I made a GET request to this exact test link (generic sample ...
1
vote
2answers
66 views

Authorization Header in dev tools

My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call. This will expose the ...
1
vote
3answers
136 views

Authentication & Authorization via md5(userid + secret + endpoint + payload)?

I am currently developing against a RESTful API that seemingly has a rather weird auth flow. I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID). Now, ...
0
votes
0answers
67 views

APIs Security for publicly exposed APis for Website/App

We have a website using PWA Client calls / Mobile APP, all using the same APIs. We have APIs Exposed to Public. Currently, our APIs are not secure meaning that anyone can check APIs signature via ...
-2
votes
1answer
101 views

Securing a read-only REST service for mobile access

I am writing a mobile app that uses a read only REST service that sits behind our company firewall. The actual data supplied by the REST service is not private but I am concerned with a hacker using ...
0
votes
2answers
141 views

How to prevent CSRF attacks on a REST API when using Windows Authentication

I have a Angular web app that interacts with a REST-API. Requests are authenticated with a JWT Bearer token. I now want to add support for Windows-Authentication. My current plan is to add a POST-...
22
votes
8answers
6k views

Protect API from being tampered?

I'm building an API with websocket that serializes data through JSON. The App itself is a chat application. I came up with the following structure to send my data: {date: '2020-05-31', time: '14:28:...
5
votes
3answers
922 views

Should we encrypt all REST API calls from a mobile device?

I have a mobile application and the backend is hosted on a cloud provider. I would like to ask for feedback on encrypting all REST API calls that will be used to communicate with the server, if we ...
1
vote
0answers
130 views

REST API scanning using WebInspect

I am trying to scan our internal site's REST APIs using WebInspect. As the site does not yet follow the Open API Standards or use the Swagger tool, it does not have a .json file that contains the API ...
0
votes
0answers
44 views

Connecting to REST server w/ digest auth using postman

Im having a hard time with a CTF, i managed to exploit a path traversal vulnerability that lead me to read a configuration file in php that indicates: define('rest_auth', 'digest'); define('...
7
votes
1answer
214 views

Does PUT or DELETE offer any security advantage over GET or POST?

I have a REST API and I want to handle all HTTP requests via POST. Is there any security issue in using just POST to perform all CRUD operations requested by a user, which sends JSON specifying the ...
0
votes
1answer
149 views

Private REST API accessible only via SSH?

We are trying to bulletproof our server from DDoS / MIM etc. Use case: Clients (<5 in number) want to get some data from remote server Client open SSH connection to server, they can now access ...
0
votes
1answer
82 views

It seems someone or something is replicating my requets

I have a personal service which is deployed on one VPS. The service works based on http requests, and it is due specific goal and handling three types of requests. The order matters in the requests. ...
0
votes
0answers
62 views

How to secure API used by third-parties?

What I am building is service that can be consumed by third-party. Something like Omdb API for example. For my service to be functional I needed to disable CSRF on some endpoints. How can I secure ...
3
votes
1answer
151 views

How to secure REST API for parameter manipulation?

I am developing secure payment APIs, i want to avoid manipulation of API parameters and fired same API again. For example, following is the API call https://api.payment.com/wallet/transfer?...
1
vote
1answer
63 views

How to ensure JWT security in authentication?

I have implemented a backend as a REST API. To maintain the statelessness in REST, I intend to use JWT to verify that that a user has logged in or not. (A user is logged in if a valid token is present ...
0
votes
2answers
82 views

Angular (2+) code visibility to users

I'm looking into Angular and read that typescript is compiled to javascript. Is everything viewable/visible to users that I write using typescript? With PHP I know you run code that's only visible to ...
0
votes
2answers
111 views

Is it safe to publish a REST API client on npm even though the API is not intended for public use?

I am build a website in Angular which communicates over my REST API on my backend server. I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on ...
1
vote
1answer
62 views

Security Risk of outbound web calls [closed]

What possible risks/attack vectors could be introduced be allowing my server application to make outbound calls to a 3rd party REST API? The 3rd party REST API is off premises and owned and operated ...
1
vote
0answers
73 views

Is it possible to get hacked by a redirection placed inside a Facebook Graph URL?

Basically, I have a webapp which needs to check the validity of the user of an Android app. After completing the basic login flow with Facebook in the Android app, a Facebook access token is sent to ...
1
vote
1answer
714 views

How to invalidate JWT tokens without a database lookup with each request to the server?

JWT Bearer token and stateless REST API question I am implementing a stateless REST API. I am used to using sessions built into frameworks or 0Auth but now I am in the process of developing my own ...
2
votes
0answers
96 views

Is it safe to let users enter a URL in my app that queries an external REST api?

The idea was to allow users to enter a URL inside the application that would send a request to my backend, fetch the data, and load it into a local cache (Apollo/GraphQL). The only sensitive data sent ...
0
votes
1answer
76 views

Token Based Authentication

I have a React app that connects to a REST API for which I have to implement token based authentication. The only info stored in the token is the user id. The following flow will be used: User logs ...
0
votes
1answer
73 views

Golang REST API: Security checks? [duplicate]

It's my first time building and deploying a REST API with just the standard library. Are there any gotchas I should keep an eye out for regarding securing my REST API?
1
vote
0answers
59 views

Calling Powershell script from external program passing an argument

I have an external program which calls a PowerShell script with a random secret identifier as a single argument. The PowerShell script needs to return the same random secret id when it calls the REST ...
0
votes
0answers
44 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...
2
votes
1answer
305 views

Securing API access. oAuth Client Credentials vs client ID and secret

I have a REST API that will be called by other external 3rd party servers over the internet and be used only for machine to machine communication. I am looking for mechanisms to secure this API such ...
4
votes
2answers
167 views

Is this security scheme using passwords, short-lived access JWTs, and long-lived refresh tokens a good way to secure a REST API?

I'm trying to secure a REST API that I'm using as a backend for a single-page application. The API provides access to read/create/modify/delete protected resources, based on a set of permissions ...
0
votes
2answers
119 views

Windows Account Password Resetting process for large network

I am working on large windows based network environment (Active Directory) and I have a requirement of implementing clear and secure password reset process for windows user. Especially management ...
1
vote
1answer
68 views

How to protect against injection into a 3rd party REST API?

I have a 3rd party API that I need to connect to and they allow queries that can be formed by changing url parameters. E.g. /data?startDate=2019-01-01 or /data?name='John Doe' It is easy to form ...
1
vote
1answer
60 views

Is using an access token for authentication a bad idea

Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
0
votes
2answers
115 views

JWT vs custom encryption for REST APIs over https

For our REST API architecture, we are currently thinking over two options - Json Web Token - pros are that it is industry standard, we pass a key which adds a layer of access control and using which ...
0
votes
0answers
74 views

How to protect API that should be accessible to everyone? [duplicate]

I have some API that should be accessible from a very long list of devices (some of them can reach my Oauth2 server and get some token, some of them cannot). These devices are mobile phones (IOS, ...
1
vote
0answers
90 views

Security aspect in the API gateway area

I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level. Scanning REST APIs (see http://docs.w3af....
2
votes
2answers
145 views

Does TLS have any way of exposing only the URI in a SSL-SSL proxy, or BlueCoat style appliance?

I'm writing an experimental authentication protocol and need to see the unencrypted URI's of the HTTP Call, but want to provably show that I can't see the data. Does any standard, or feature exist ...
1
vote
1answer
79 views

Secure REST API that only works for users authenticated by App with SSO (OAuth?)

I somehow need to accomplish the following: User accesses a application written in JavaScript. Application uses SSO to identify the user who is logged into Windows. Application obtains the access ...
0
votes
2answers
2k views

Rest API Sensitive Data GET

We are trying to decide the best approach to designing our new interface with our consumers. Currently we are talking about an Rest API. However there is some debate among our team about how to ...
1
vote
1answer
122 views

Security and the Definition of Ready and Done [closed]

Currently I am in a project where I have to test REST APIs among other things. In another question of mine I also discussed the topics Definition of Ready and Definition of Done regarding security. ...
0
votes
2answers
137 views

Rest API Security Guideline. Developer Rules? [closed]

In my current project I am also setting up the area of security testing. So far there was no way to use security within the REST API development. Beside the known approach, e.g. using static software ...
5
votes
4answers
120 views

Security considerations of consuming public API

I have a website and i want to consume public API from third party services such as Zoopla, weather etc. I want to ensure i do not consume malicious code/malware from the data retrieved from the 3rd ...
1
vote
0answers
88 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
0
votes
0answers
44 views

Public report/telemetry API

I want to implement a telemetry data sender into my electron app. The API which I want to connect to is public. So any crash reports or any other data from the user is sent to it. The problem is how ...
1
vote
1answer
82 views

Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?

I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
1
vote
0answers
61 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
2
votes
1answer
738 views

Exploitability of allowed wildcard (*) CORS Origins with Bearer Token Authorization [duplicate]

I'm looking at the following setup. A web application uses a REST API to communicate with the server. All API responses include Origin: *. For authorization Authorization: Bearer <token> is used....
0
votes
1answer
67 views

Preventing an unauthorized mobile application from calling REST back end services [duplicate]

In my scenario, I have an Android mobile application which calls my back end REST services. I want prevent other application to call my back end REST services. If I use certificate and shared key as ...
1
vote
1answer
346 views

Should I report this Google API key disclosure issue or not?

I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to: https://www.googleapis.com/customsearch/v1/...

1
2 3 4 5
7