Questions tagged [rest]
An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.
378
questions
1
vote
0
answers
35
views
RESTful API with Google API and OAuth2
As the title says, I want to create a RESTful API (stateless) that will access Google API endpoints. First I want to authenticate the user and then use that token provided by Google to access Google ...
- 11
0
votes
1
answer
46
views
Information leakage from a API 404 response
Our consulting company has received a VAPT from a consulting company on behalf of a financial customer.
The application has an HR/group management module.
Normally employees are created by an ...
- 5,361
1
vote
1
answer
331
views
Is it safe to send an API key in an HTTPS request? [duplicate]
Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ?
We need to send data to a 3rd party from ...
- 113
4
votes
1
answer
113
views
REST API authorization
Let say you have a REST API, which you want to use as the backend for React application. The application supports user login. You use JWT authorization to make that REST API stateless. Now the problem ...
- 43
1
vote
1
answer
125
views
Authentication using JWT signature, without header and payload
I am evaluating JWT as authentication mechanism for an API. The idea is to use JWT as API key.
One thing I want to implement is revoking API keys. Since revoking involves a state change in my backend, ...
- 113
1
vote
3
answers
72
views
Limit REST API calls by fingerprinting and IP
I have a question regarding request limits for a REST service endpoint.
I think of course the most basic identification used to limit requests is by taking the user's IP address, but what if we have ...
- 11
1
vote
0
answers
582
views
Why "application/x-www-form-urlencoded" is normally used for login but not for registration?
I may be wrong, but for security reasons, in REST APIs the login credentials are always sent with the content type application/x-www-form-urlencoded. But I haven't seen the same with user registration;...
- 11
0
votes
0
answers
25
views
Securing many infrastructure servers sitting behind a centralised web server
Problem
We have 100+ servers that we are looking to manage through a REST API.
The REST API for each of these servers will only ever be consumed from our Centralised Management Server (CMS). Therefore,...
- 101
0
votes
0
answers
25
views
Authentication in RESTful APIs using proof of private key
I know that breeding your own security is bad practice, however I couldn't find anything about this on the internet.
So I basically want to add an authentication mechanism where the client proves that ...
- 142
1
vote
1
answer
35
views
How do you call REST API resource unintentional field modifying?
Today I stumbled on a potential vulnerability where I could change my profile rank. I'm pretty sure that should not be allowed for regular users.
Let's say, for example; I got an account profile ...
- 11
0
votes
1
answer
179
views
Path traversal in REST style URLs?
Can path traversal vulnerabilities occur in REST style URLs?
For example: https://x.com/filename/img.jpeg
https://x.com/filename/../../../../../etc/passwd
Does this make sense ?
- 11
3
votes
1
answer
91
views
REST API behind proxy, is TLS sufficient?
I have the following problem:
A service provides a REST API. Different kinds of clients (desktop applications, mobile applications, web applications) connect to this API and send and receive data. In ...
- 31
0
votes
1
answer
382
views
Why REST APIs that do not use RSA encryption to secure API keys?
After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key.
The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
2
votes
1
answer
121
views
use md5 hashed guid as app login and REST interface
We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest - api. All communication is over a secured https channel. The REST api is programmed to resist XSS ...
- 147
0
votes
0
answers
23
views
DNS spoofing an API? [duplicate]
Could someone DNS spoof REST API communication between a client device POST to a server URL running a XML-based API on HTTPS?
If a man-in-the-middle for client device(s) POSTing to the server on a ...
- 101
0
votes
1
answer
81
views
Impact of setting allowUrlEncodedPercent to true in StrictHttpFirewall
I need to implement a public REST API that manipulates usernames.
So I have an endpoint that looks like GET http://.../api/users/<username> where username can contain special characters (slashes,...
- 3
1
vote
0
answers
214
views
CSRF and XSS Protection with a Static Site and REST API
I'm building an application which will support both browser and application access to REST resources.
Applications will POST a username/password JSON body to a login endpoint which will return a ...
- 6,745
0
votes
0
answers
58
views
authentication for SDK requests to a private API
I have an API that responds to requests with a JSON that contains app updates and advertisements.
Requests are sent by my SDK that is implemented inside my game.
I need authentication because JSON ...
- 101
1
vote
1
answer
937
views
How to implement the CSRF token mechanism for restful APIs?
Considering the following facts, using CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable:
storing JWT in local storage(any where other than http-only cookie) ...
- 113
0
votes
0
answers
94
views
Is using a developer key to protect a REST API good practice?
I'd like to implement a RESTful API service over HTTP that developers can call from their server side environments.
I intend to use a cryptographically secure pseudo-random number generator (CSPRNG) ...
- 113
0
votes
1
answer
2k
views
CheckMarx SSRF Vulnerability
I have a REST which takes a parameter dataSource as input and myService has follow logic.
@RequestMapping(value ="/save", method = RequestMethod.POST)
public List<String> find(@...
0
votes
1
answer
1k
views
Cookies Vs Headers For REST API User Authentication Token
I'm working on a small rest api project with user authentication.
But I'm wondering whether I should store the users authentication token in a header or a cookie.
The general idea is as follows:
User ...
- 3
0
votes
1
answer
80
views
Is it possible to avoid exposing the fact that an e-mail address is used by a web application (API) while still ensuring a decent UX?
One of the raised issues for a Web API is that for an e-mail based authentication (e-mail and password) the Register user method returns something like "the registration e-mail has been sent"...
- 2,183
0
votes
3
answers
172
views
Security issues of exposing CRUD operations through a single API endpoint?
Imagine an API where all CRUD operations are done through the same POST HTTP Request but with different "action" values from request body.
{
"action":"[create|read|update|...
1
vote
1
answer
685
views
OWASP Pentest - "Sensitive data sent in clear text" [closed]
We have our web app / REST API getting tested by potential customer. In the report they came up with this issue:
Sensitive data like user credentials on login page, password reset,
change password ...
- 121
1
vote
0
answers
197
views
Is masking JWT custom claims a good practice?
We use JWT tokens in our Rest API(Bank API) authentication with a normal payload like:
{
"user_id": "cdda338f-50e2-4e14-9f84-33b8a158db9f",
"tenant_id": "...
- 131
0
votes
0
answers
88
views
How to authenticate OAuth2 confidential client is making a REST call?
We are looking to implement some REST services to be called from partner servers (not end users via a browser).
The out-of-the-box implementation seems to flow thusly:
Partner server passes a client ...
- 101
2
votes
1
answer
403
views
Can one send data securely to a REST API endpoint
Say I have an endpoint to create a username:
https://example.com/api/create_user/foo/1234/ or
https://example.com/api/create_user/?name=foo&token=1234
Where username = foo and the api token is ...
- 125
1
vote
0
answers
424
views
Basic authentication after mTLS?
I work for a software company and I'm currently doing research for an enhancement request. Essentially we have a application client which talks to a rest end point which is authenticated using basic ...
- 11
2
votes
2
answers
173
views
Access Control for REST APIs - OWASP recommendation
OWASP states:
Non-public REST services must perform access control at each API
endpoint. Web services in monolithic applications implement this by
means of user authentication, authorisation logic ...
0
votes
0
answers
317
views
Best secure approach with Basic Auth
Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account.
We are using Bcrypt to store customer's password in our DB, ...
- 101
0
votes
1
answer
1k
views
REST API is protected by HMAC based authentication. What does including URL path in the message protect from?
I have came across a REST API for some commercial software, that checks authentication by requiring HMAC on concatenation of
http_method (GET, PUT, etc)
timestamp
payload (body of a POST / PUT ...
- 1,640
0
votes
0
answers
1k
views
JWT token. Send in a cookie or Auth header depending on Rest vs MVC?
Reading around I gather that for a Restful API since you don't use cookies,then you send the token in the Auth header.Correct so far?
When on a traditional MVC app ,do you send the token inside a ...
- 2,141
0
votes
1
answer
215
views
Replace hashed password by public key generated from password
I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
- 131
2
votes
1
answer
155
views
Authentication for website and mobile app
This doing a Spring Boot application (Rest API, JPA, etc) uses (via Rest) from a website (Angular) and a mobile app (Android).
The user using the mobile app (in the future) will be able to ...
- 21
0
votes
2
answers
157
views
Reject requests from our tampered android apps
I'm working on an Android application with few millions of users. The app has some financial|payment features. We have some public APIs and some authenticated ones (OAuth2). As a part of enhancing our ...
- 109
2
votes
3
answers
238
views
How can I prevent API bot automation by a legitimate user?
My web application is a long sequence of games, which submit progress results back to the server via a web API. These progress messages are how we know how many points the user has earned. The points ...
- 207
2
votes
2
answers
865
views
How could a server to server rest api communication be more secure, by using OAuth 2?
I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
- 183
0
votes
2
answers
395
views
API key safety in front end app running in localhost
I have been working on a front end (React) app that sends REST requests to an API end point. I am aware that sensitive items such as API keys should not be stored in front end frameworks (like React, ...
- 145
0
votes
1
answer
186
views
RestApi Libsodium SealedBox end-to-end request encryption scheme
I am making an API that uses the following steps for encryption. All of this is implemented using libsodium.
First of all the client has to make an initial request to the server for getting his public ...
0
votes
1
answer
84
views
Are there any identity providers which support securing RESTful interfaces using digital signature?
I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract:
When signing, the sender uses ...
- 101
3
votes
1
answer
765
views
What else can be used instead of an API Key to protect resources in a REST API as is implied by OWASP?
I was reading the OWASP Cheat Sheet Series, specifically their cheat sheet for REST Security and one of the points they had under the section for API Keys was:
Do not rely exclusively on API keys to ...
- 227
1
vote
1
answer
1k
views
Secure REST API for mobile and web application usage
I have been reading about authentication and authorization for the past few days and I still have not figured out what would be a reasonable way to deal with this for both mobile and web applications.
...
- 111
0
votes
1
answer
143
views
Secure a REST API
I want to build a REST API where applications can authenticate using an OAuth2 Bearer Token, so they get access only to resources related to one user or they can access by itself accessing resources ...
- 103
29
votes
6
answers
6k
views
Is splitting a REST API server from a Web server considered a security threat?
I am participating in a project that involves a JavaScript SPA that provides a service and is intended to interact via REST APIs with one of our servers. Initially, I proposed to work on the two ...
- 401
1
vote
2
answers
2k
views
How to not use database identifiers in a URL in the context of a REST API
During my IT school years, I was told that including rows identifiers from a database in the resource URL, in the context of a REST API, is a bad practice. To my understanding, the rationale behind ...
- 11
0
votes
1
answer
489
views
B2B authentication best practices
I'm in the process of developing a B2B (business-to-business) application. I've implemented JWT auth, and it is working as expected. Right now the authentication functions as if it were a B2C (...
- 101
1
vote
2
answers
4k
views
Authorization Header in dev tools
My web application need to make call to 3rd party REST API which is protected by Basic authentication on some user click. We are planning to use a technical user for the call.
This will expose the ...
- 275
1
vote
3
answers
1k
views
Authentication & Authorization via md5(userid + secret + endpoint + payload)?
I am currently developing against a RESTful API that seemingly has a rather weird auth flow.
I got an API key consisting of an ID (public) and a "secret" (which seems to be a UUID).
Now, ...
- 13
0
votes
0
answers
122
views
APIs Security for publicly exposed APis for Website/App
We have a website using PWA Client calls / Mobile APP, all using the same APIs.
We have APIs Exposed to Public. Currently, our APIs are not secure meaning that anyone can check APIs signature via ...
- 157