Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

2
votes
2answers
70 views

Unauthorized API Access Without Key Header

In order to test the security of my API, I want to act as sort of an attacker in order to try and gain access to my own API without an API key. In order for me to send requests to this endpoint, I ...
0
votes
1answer
43 views

Is IP whitelisting safe enough for a HTTP Basic protected service available on the internet?

We are discussing about making available through the internet one of our microservices deployed on a public cloud on Kubernetes. This ms offers some sensitive information to the clients. This ...
1
vote
0answers
16 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
13
votes
3answers
2k views

Why should someone block all methods other than GET and POST in a RESTful application?

TL;DR: Is there a valid reason to demand a software vendor to stop using HTTP PUT and DELETE methods in a web application and use only GET and POST? The application uses frameworks to whitelist ...
0
votes
0answers
41 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
0
votes
1answer
110 views

What all test cases/vulnerabilities we need to try in REST API Pen testing?

I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API. I have gone through the OWASP resources ...
0
votes
2answers
62 views

How can I secure a REST service intended to be used by my customers' customers via their public website?

I am developing a service with an associated REST API for customers (companies which have their own websites) to use. In other words, one of my customers would typically make the REST call directly ...
0
votes
0answers
22 views

How to let any number of external servers securely register to receive updates from my own server

My scenario is as follows: On one side I have a single server running an application, which I control fully. On the other, there can be any number of other servers that have to connect to my server ...
2
votes
2answers
99 views

Sensitive data enumeration via HTTP error codes

Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user Bob a message to his cell phone which he registered on our ...
1
vote
0answers
35 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
0
votes
0answers
31 views

Are REST Authentication schemes that expose shared key protected against reverse proxies acting as bad user agents?

Recently a situation arose where a client wants a public API that doesn't require registration or login by the user (no password). The security team has identified that the server-side API needs to ...
4
votes
2answers
117 views

Deal with API Webhooks that refuses authenticating itself

I'm currently in the process of writing a connector to an API. It's for an automated shipping system and I'm required to listen to events from that given API, sent via Webhooks. The API owner does ...
0
votes
0answers
76 views

Exposing protected API without hardcoding credentials in the Client (JS)

Try to expose protected REST API without exposing credentials in the Client (JS Code). All solutions that come to my mind, can be reversed and the Attacker can reconstruct them. Are there any ...
2
votes
4answers
85 views

Are there any reasons to add payload signature to a rest API with mutual TLS?

We have a B2B Rest API with Client Certificate authentication. Are there any reasons to add also a payload signature check to this API? I'm seeing many service providers which add a digital signature ...
0
votes
2answers
394 views

CSRF Origin and Referer Header just check host?

Note: This question is not the same as the linked possible duplicate. That question asks how checking the origin/referer header protects against CSRF. This questions is asking how to implement the ...
0
votes
0answers
70 views

Machine Learning based application vulnerability scoring

This question is related to an earlier questions: 1 & 2 about the limitations in web application vulnerability scoring/automated vulnerability scoring. Indeed, scoring vulnerabilities detected in ...
1
vote
1answer
289 views

Hash a secret API key with a random salt instead of sending sending it alone in REST API

Say, I have an internal https API endpoint used only by me being the admin. In each each request I send a secret API key for authentication. And I'm fine with this solution. curl -x PUT ....... -...
2
votes
1answer
1k views

A simplistic stateless alternative to HTTP basic auth for API's

Many API's (services) today use OAuth, HTTP Basic Authentication or API keys to authenticate their users. My goal is to find a simplistic secure way to authenticate users in a client-side ...
5
votes
2answers
307 views

Is it safe to use a stateless authorization mechanism where the clear password is stored on the keychain?

Is it safe to use the following stateless authorization mechanism between a client (iOS & Android) and server? Sign up The client provides an email and password and saves the clear password on ...
-2
votes
2answers
221 views

Using AES CBC PKCS5PADDING for REST API?

I am planning to use AES CBC PKCS5PADDING with a passphrase to encrypt my REST API traffic to POST/GET over HTTPS from an Android application. the scope is to protect user data from MITM attacks and ...
4
votes
1answer
71 views

How is this registration setup vulnerable?

I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are ...
0
votes
0answers
110 views

Securing mobile app API Using UDID and Argon2

I'm trying to build an iOS app, I have wrote the code and all, and now I am implementing the APIs to communicate with the database. The app will be using HTTPS and POST Requests to communicate with ...
0
votes
0answers
82 views

Authenticate against third party with OTP

First of all I want to mention, that I absolutely do NOT want to implement my own crypto in any way. I was just thinking about this topic and after some research I was not finding a good solution. I ...
1
vote
0answers
46 views

Restrict Public API To Access From Single App

I have a REST api on a server and an application for android phones that mostly makes calls to that api and presents the info to the user. Because the application needs to be a quick way to lookup ...
2
votes
2answers
98 views

Security on a REST Api used from a JS

I am developing an application where I provide a JavaScript to my clients (stored on my CDN), and they can load it to their web pages via script tag. This JavaScript does some checks on the DOM and ...
2
votes
1answer
330 views

SSL certificate for WebAPI

We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be ...
0
votes
0answers
28 views

Rest service Password securing [duplicate]

I have a REST service A, which communicates with REST service B (both are internally hosted within the company network). REST service B is accessed via a service ID & plain password. How do I ...
1
vote
1answer
162 views

Why using oAuth2 refresh token is more secure then regenerate an access_token?

I'm implementing an oAuth2 authentification to secure my REST Api. As I am implementing oAuth2, I need to generate an access_token which will give me a temporary access to my REST datas. To do it, I ...
0
votes
1answer
73 views

Authentication in RestAPI

I want to implement a security mechanism by which i can secure my RestApi from the "Clients who are not what they claim to be". In my case the consumer of API for now is another web service not ...
43
votes
10answers
20k views

Is it more secure to program a client-server system in a language other than English?

I'm developing a system with communication via REST between front (JavaScript) and back end (Java/Spring) and this question popped up. Does it makes this system more secure to name variables, URLs, ...
0
votes
1answer
488 views

How I can enumerate all endpoints of an API?

Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?
3
votes
2answers
120 views

Is switching protocols a security measure worth implementing?

We deploy our internet facing applications in multiple vlans and there is a rule that talking from one vlan to the next has to be done in another protocol or an other implementation of the protocol. ...
27
votes
3answers
6k views

Generating one time URLs which can be revoked

I have a requirement to generate a one time use URL which should have the following features: As the URL query parameters may contain sensitive information, it should be encrypted (on top of https ...
0
votes
0answers
186 views

How to store `client_secret` privately on frontend applications?

I am trying to understand how authentication and authorization should work with a REST API given that the API will be available to be used by third-party applications. I realize that if we allow ...
1
vote
0answers
107 views

Security of Publicly exposed REST APIs

We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple ...
1
vote
0answers
178 views

tool with rest api to scan base64 encoded files [closed]

I'm searching for a tool (antimalware / antivirus) that exposes a REST API and accept me to pass a base64 encoded file in order to check if it's a malicious one or not. I've tried the ClaimAV but it ...
1
vote
4answers
594 views

How to prevent self-XSS?

I am creating a website which solely uses REST api for all the features and functionality, from signup and login to fetching data and populating the webpage using Mustache as template engine for ...
5
votes
1answer
5k views

Store Auth-Token in Cookie or Header?

I do understand that a header is the "cleaner" solution to transport an auth-token from a trusted system to another in a REST call. But when you are in client-side JavaScript code, the world looks ...
3
votes
2answers
2k views

Do I need to hash or encrypt API keys before storing them in a database?

I'm securing API calls to a REST service I'm building using API Keys. The plan is to: When we get a new client, generate an API Key (a UUID). Email the API key to them. They send the API key on every ...
1
vote
1answer
677 views

Store splitted JWT for CSRF protection and refresh strategy

I've been reading a lot about stateless authentication systems, and I want to implement something with JWT for the first time, but now I'm concerned about how to properly (and securely) consume a ...
0
votes
2answers
84 views

Secure way to send files to server, store, then retrieve

I am looking for ideas today. The problem: Sensitive files are sent via REST (over SSL, of course) to a third-party server. I cannot touch them programmatically until they arrive at the server. Those ...
3
votes
1answer
769 views

Secure RESTful api communication between multiple servers

Currently I have the following design: Central cloud hosted server with a REST api Multiple remote servers each with a REST api Data is posted from the remote servers to the central server at ...
1
vote
1answer
80 views

Best way to secure local REST server?

Currently I have a raspberry pi connected to my home security system. I have written a Python daemon running a HTTP server (very insecure I know, but this is still under construction) so I can send it ...
-1
votes
1answer
74 views

Is there any reason to use an encrypted value for the plain text signing key?

I am creating an API and I am thinking of using an encrypted value of some random password as the value to store for the plain text representation of my signing key. Is this just a vain attempt to ...
1
vote
0answers
528 views

Using burp-rest-api, how do I log into my web application in order to scan for vulnerabilities?

I am using the VMWare-developed Burp API (https://github.com/vmware/burp-rest-api) in order to try to automate web application scanning for my application. For an example, if I was attempting to test ...
2
votes
1answer
635 views

Why isn't Secure Remote Password protocol being used in REST APIs?

I have seen a few samples of SRP protocol used for web applications and I wonder why nobody ever uses it for RESTful authentication. I have done some research and I couldn't find any single example, ...
3
votes
1answer
1k views

Do I need additional encryption on top of HTTPS for a REST API?

Let's set up the environment before coming to my question. We have an web application which will be accessible by browsers/clients over HTTPS. Monstly only accessible in the intranet ( rarely over ...
6
votes
2answers
946 views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...
0
votes
1answer
321 views

Content-Type for a JWE Compact Serialization payload

The scenario is that the same code library is used by both client and server to encrypt/decrypt messages. The server application uses the library's encryption function to encrypt some content (that ...
2
votes
1answer
305 views

How to secure refresh token API's?

I have two API's used in auth: api/auth/newtoken: Successfully validates user (i.e. username and password check in DB) and return token (expirers in 3 days) and refreshToken. api/auth/updatetoken: ...