Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

Filter by
Sorted by
Tagged with
1 vote
0 answers
30 views

Why "application/x-www-form-urlencoded" is normally used for login but not for registration?

I may be wrong, but for security reasons, in REST APIs the login credentials are always sent with the content type application/x-www-form-urlencoded. But I haven't seen the same with user registration;...
0 votes
0 answers
25 views

Securing many infrastructure servers sitting behind a centralised web server

Problem We have 100+ servers that we are looking to manage through a REST API. The REST API for each of these servers will only ever be consumed from our Centralised Management Server (CMS). Therefore,...
0 votes
0 answers
22 views

Authentication in RESTful APIs using proof of private key

I know that breeding your own security is bad practice, however I couldn't find anything about this on the internet. So I basically want to add an authentication mechanism where the client proves that ...
  • 142
1 vote
1 answer
34 views

How do you call REST API resource unintentional field modifying?

Today I stumbled on a potential vulnerability where I could change my profile rank. I'm pretty sure that should not be allowed for regular users. Let's say, for example; I got an account profile ...
  • 11
0 votes
1 answer
62 views

Path traversal in REST style URLs?

Can path traversal vulnerabilities occur in REST style URLs? For example: https://x.com/filename/img.jpeg https://x.com/filename/../../../../../etc/passwd Does this make sense ?
3 votes
1 answer
82 views

REST API behind proxy, is TLS sufficient?

I have the following problem: A service provides a REST API. Different kinds of clients (desktop applications, mobile applications, web applications) connect to this API and send and receive data. In ...
0 votes
1 answer
161 views

Why REST APIs that do not use RSA encryption to secure API keys?

After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key. The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
2 votes
1 answer
64 views

use md5 hashed guid as app login and REST interface

We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest - api. All communication is over a secured https channel. The REST api is programmed to resist XSS ...
  • 149
0 votes
0 answers
22 views

DNS spoofing an API? [duplicate]

Could someone DNS spoof REST API communication between a client device POST to a server URL running a XML-based API on HTTPS? If a man-in-the-middle for client device(s) POSTing to the server on a ...
  • 101
0 votes
0 answers
63 views

Security Practices for a React App - Node.js - Notion REST API Pipeline

I've been thinking about security practices for a personal project where I would create content on a Notion account and have a Node.js middleware server that'll act as a REST API that allows anybody ...
0 votes
1 answer
50 views

Impact of setting allowUrlEncodedPercent to true in StrictHttpFirewall

I need to implement a public REST API that manipulates usernames. So I have an endpoint that looks like GET http://.../api/users/<username> where username can contain special characters (slashes,...
1 vote
0 answers
160 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
  • 6,715
0 votes
0 answers
55 views

authentication for SDK requests to a private API

I have an API that responds to requests with a JSON that contains app updates and advertisements. Requests are sent by my SDK that is implemented inside my game. I need authentication because JSON ...
  • 101
1 vote
1 answer
440 views

How to implement the CSRF token mechanism for restful APIs?

Considering the following facts, using CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable: storing JWT in local storage(any where other than http-only cookie) ...
  • 113
0 votes
0 answers
89 views

Is using a developer key to protect a REST API good practice?

I'd like to implement a RESTful API service over HTTP that developers can call from their server side environments. I intend to use a cryptographically secure pseudo-random number generator (CSPRNG) ...
0 votes
1 answer
964 views

CheckMarx SSRF Vulnerability

I have a REST which takes a parameter dataSource as input and myService has follow logic. @RequestMapping(value ="/save", method = RequestMethod.POST) public List<String> find(@...
0 votes
1 answer
514 views

Cookies Vs Headers For REST API User Authentication Token

I'm working on a small rest api project with user authentication. But I'm wondering whether I should store the users authentication token in a header or a cookie. The general idea is as follows: User ...
  • 3
0 votes
1 answer
69 views

Is it possible to avoid exposing the fact that an e-mail address is used by a web application (API) while still ensuring a decent UX?

One of the raised issues for a Web API is that for an e-mail based authentication (e-mail and password) the Register user method returns something like "the registration e-mail has been sent"...
  • 2,183
0 votes
0 answers
172 views

Refresh token rotation or Authorization Code Flow with PKCE

In a new project, we try to clarify how authorization should look like. I've been reading up on this for days, but it's not really clear to me which solution would be the right one to use. Some ...
  • 101
0 votes
3 answers
137 views

Security issues of exposing CRUD operations through a single API endpoint?

Imagine an API where all CRUD operations are done through the same POST HTTP Request but with different "action" values from request body. { "action":"[create|read|update|...
1 vote
1 answer
416 views

OWASP Pentest - "Sensitive data sent in clear text" [closed]

We have our web app / REST API getting tested by potential customer. In the report they came up with this issue: Sensitive data like user credentials on login page, password reset, change password ...
  • 121
1 vote
0 answers
139 views

Is masking JWT custom claims a good practice?

We use JWT tokens in our Rest API(Bank API) authentication with a normal payload like: { "user_id": "cdda338f-50e2-4e14-9f84-33b8a158db9f", "tenant_id": "...
0 votes
0 answers
86 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
2 votes
1 answer
252 views

Can one send data securely to a REST API endpoint

Say I have an endpoint to create a username: https://example.com/api/create_user/foo/1234/ or https://example.com/api/create_user/?name=foo&token=1234 Where username = foo and the api token is ...
1 vote
0 answers
269 views

Basic authentication after mTLS?

I work for a software company and I'm currently doing research for an enhancement request. Essentially we have a application client which talks to a rest end point which is authenticated using basic ...
2 votes
2 answers
153 views

Access Control for REST APIs - OWASP recommendation

OWASP states: Non-public REST services must perform access control at each API endpoint. Web services in monolithic applications implement this by means of user authentication, authorisation logic ...
0 votes
0 answers
190 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
0 votes
1 answer
754 views

REST API is protected by HMAC based authentication. What does including URL path in the message protect from?

I have came across a REST API for some commercial software, that checks authentication by requiring HMAC on concatenation of http_method (GET, PUT, etc) timestamp payload (body of a POST / PUT ...
0 votes
0 answers
904 views

JWT token. Send in a cookie or Auth header depending on Rest vs MVC?

Reading around I gather that for a Restful API since you don't use cookies,then you send the token in the Auth header.Correct so far? When on a traditional MVC app ,do you send the token inside a ...
  • 2,101
0 votes
1 answer
182 views

Replace hashed password by public key generated from password

I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
2 votes
1 answer
143 views

Authentication for website and mobile app

This doing a Spring Boot application (Rest API, JPA, etc) uses (via Rest) from a website (Angular) and a mobile app (Android). The user using the mobile app (in the future) will be able to ...
0 votes
2 answers
149 views

Reject requests from our tampered android apps

I'm working on an Android application with few millions of users. The app has some financial|payment features. We have some public APIs and some authenticated ones (OAuth2). As a part of enhancing our ...
2 votes
3 answers
208 views

How can I prevent API bot automation by a legitimate user?

My web application is a long sequence of games, which submit progress results back to the server via a web API. These progress messages are how we know how many points the user has earned. The points ...
2 votes
2 answers
712 views

How could a server to server rest api communication be more secure, by using OAuth 2?

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
  • 183
0 votes
2 answers
260 views

API key safety in front end app running in localhost

I have been working on a front end (React) app that sends REST requests to an API end point. I am aware that sensitive items such as API keys should not be stored in front end frameworks (like React, ...
  • 145
0 votes
1 answer
175 views

RestApi Libsodium SealedBox end-to-end request encryption scheme

I am making an API that uses the following steps for encryption. All of this is implemented using libsodium. First of all the client has to make an initial request to the server for getting his public ...
0 votes
1 answer
83 views

Are there any identity providers which support securing RESTful interfaces using digital signature?

I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract: When signing, the sender uses ...
2 votes
1 answer
550 views

What else can be used instead of an API Key to protect resources in a REST API as is implied by OWASP?

I was reading the OWASP Cheat Sheet Series, specifically their cheat sheet for REST Security and one of the points they had under the section for API Keys was: Do not rely exclusively on API keys to ...
  • 217
1 vote
1 answer
884 views

Secure REST API for mobile and web application usage

I have been reading about authentication and authorization for the past few days and I still have not figured out what would be a reasonable way to deal with this for both mobile and web applications. ...
  • 111
0 votes
1 answer
140 views

Secure a REST API

I want to build a REST API where applications can authenticate using an OAuth2 Bearer Token, so they get access only to resources related to one user or they can access by itself accessing resources ...
28 votes
6 answers
6k views

Is splitting a REST API server from a Web server considered a security threat?

I am participating in a project that involves a JavaScript SPA that provides a service and is intended to interact via REST APIs with one of our servers. Initially, I proposed to work on the two ...
  • 391
1 vote
2 answers
2k views

How to not use database identifiers in a URL in the context of a REST API

During my IT school years, I was told that including rows identifiers from a database in the resource URL, in the context of a REST API, is a bad practice. To my understanding, the rationale behind ...
0 votes
1 answer
376 views

B2B authentication best practices

I'm in the process of developing a B2B (business-to-business) application. I've implemented JWT auth, and it is working as expected. Right now the authentication functions as if it were a B2C (...
  • 101
1 vote
2 answers
3k views

Authorization Header in dev tools

My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call. This will expose the ...
  • 275
1 vote
3 answers
829 views

Authentication & Authorization via md5(userid + secret + endpoint + payload)?

I am currently developing against a RESTful API that seemingly has a rather weird auth flow. I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID). Now, ...
0 votes
0 answers
122 views

APIs Security for publicly exposed APis for Website/App

We have a website using PWA Client calls / Mobile APP, all using the same APIs. We have APIs Exposed to Public. Currently, our APIs are not secure meaning that anyone can check APIs signature via ...
-2 votes
1 answer
141 views

Securing a read-only REST service for mobile access

I am writing a mobile app that uses a read only REST service that sits behind our company firewall. The actual data supplied by the REST service is not private but I am concerned with a hacker using ...
0 votes
2 answers
1k views

How to prevent CSRF attacks on a REST API when using Windows Authentication

I have a Angular web app that interacts with a REST-API. Requests are authenticated with a JWT Bearer token. I now want to add support for Windows-Authentication. My current plan is to add a POST-...
22 votes
8 answers
7k views

Protect API from being tampered?

I'm building an API with websocket that serializes data through JSON. The App itself is a chat application. I came up with the following structure to send my data: {date: '2020-05-31', time: '14:28:...
  • 379
6 votes
3 answers
4k views

Should we encrypt all REST API calls from a mobile device?

I have a mobile application and the backend is hosted on a cloud provider. I would like to ask for feedback on encrypting all REST API calls that will be used to communicate with the server, if we ...
  • 163

1
2 3 4 5
8