Skip to main content

Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

Filter by
Sorted by
Tagged with
1 vote
0 answers
36 views

Log REST API calls in the most auditable way

I am working on a data processing task in an enterprise environment with Python3 installed on a client-side Windows Jump server. The data, which I need to download regularly from a third-party ...
gale44's user avatar
  • 11
0 votes
1 answer
152 views

API - exposing implementation names, and other details

In my new team, we use the API of our internal clients, whose request calls and responses contain names of our accounts with the client - for example: dingobiscuits.vodafone.com/data/fetch-something ...
julie's user avatar
  • 3
-1 votes
1 answer
170 views

PATCH request on a login attempt

I have a problem deciding what is the most secure method to send a login request with a username and password strings, I understood that PATCH is less secure than PUT while both are less secure than ...
Jan Safronov's user avatar
0 votes
1 answer
316 views

Can Burp detect new REST APIs exposed on a server

I am trying to write an automated test that runs on all exposed APIs on a server and checks each endpoint for vulnerabilities. The problem is the server I am testing always has new APIs exposed, so I ...
ethicalhacker's user avatar
0 votes
1 answer
293 views

What security issues could occur when generating ids on the client?

It's sometimes convenient to generate ids client-side in a typical CRUD app. The main benefit is for optimistic updates: you can update your client state with the right id without waiting for the ...
Emmanuel Meric de Bellefon's user avatar
0 votes
0 answers
128 views

Can I send confidential information in plain text via an HTTPS POST method?

I have a web app that collects user SSN and driver license number. A POST API via HTTPS send the data to the server. Can I use plain text to transfer the data? Is it safe enough? Is it in accordance ...
BurgerBurglar's user avatar
0 votes
2 answers
894 views

What is the difference between OWASP Top 10 and OWASP Top 10 API

There is the OWASP Top 10 which is the most known one: https://owasp.org/www-project-top-ten/ And there is the OWASP Top 10 API: https://owasp.org/www-project-api-security/ Both lists are very similar,...
ethicalhacker's user avatar
4 votes
3 answers
218 views

Leaving SSH access to deployed on prem server -- why is this bad?

I've recently had a conversation with a colleague (in a new job for me) around access to client's servers which are deployed in their premises. They have said that allowing ssh access to those servers ...
David Boshton's user avatar
1 vote
0 answers
108 views

RESTful API with Google API and OAuth2

As the title says, I want to create a RESTful API (stateless) that will access Google API endpoints. First I want to authenticate the user and then use that token provided by Google to access Google ...
ktop's user avatar
  • 11
0 votes
1 answer
186 views

Information leakage from a API 404 response

Our consulting company has received a VAPT from a consulting company on behalf of a financial customer. The application has an HR/group management module. Normally employees are created by an ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
3 votes
1 answer
4k views

Is it safe to send an API key in an HTTPS request? [duplicate]

Q: Is it 'safe' to include a secret API Key in a HEADER (for a request) which prevents bad actors from creating their own evil-requests by using your API Key ? We need to send data to a 3rd party from ...
Pure.Krome's user avatar
4 votes
1 answer
839 views

REST API authorization

Let say you have a REST API, which you want to use as the backend for React application. The application supports user login. You use JWT authorization to make that REST API stateless. Now the problem ...
random_đov's user avatar
1 vote
1 answer
1k views

Authentication using JWT signature, without header and payload

I am evaluating JWT as authentication mechanism for an API. The idea is to use JWT as API key. One thing I want to implement is revoking API keys. Since revoking involves a state change in my backend, ...
Nopx's user avatar
  • 113
1 vote
3 answers
662 views

Limit REST API calls by fingerprinting and IP

I have a question regarding request limits for a REST service endpoint. I think of course the most basic identification used to limit requests is by taking the user's IP address, but what if we have ...
NeoNeo's user avatar
  • 11
1 vote
0 answers
2k views

Why "application/x-www-form-urlencoded" is normally used for login but not for registration?

I may be wrong, but for security reasons, in REST APIs the login credentials are always sent with the content type application/x-www-form-urlencoded. But I haven't seen the same with user registration;...
something's user avatar
1 vote
1 answer
78 views

How do you call REST API resource unintentional field modifying?

Today I stumbled on a potential vulnerability where I could change my profile rank. I'm pretty sure that should not be allowed for regular users. Let's say, for example; I got an account profile ...
Venomed's user avatar
  • 11
0 votes
1 answer
705 views

Path traversal in REST style URLs?

Can path traversal vulnerabilities occur in REST style URLs? For example: https://x.com/filename/img.jpeg https://x.com/filename/../../../../../etc/passwd Does this make sense ?
charlie's user avatar
  • 21
3 votes
1 answer
190 views

REST API behind proxy, is TLS sufficient?

I have the following problem: A service provides a REST API. Different kinds of clients (desktop applications, mobile applications, web applications) connect to this API and send and receive data. In ...
Frederik's user avatar
0 votes
1 answer
876 views

Why REST APIs that do not use RSA encryption to secure API keys?

After using many APIs, I noticed that most of them offer 2 keys: API Key and Secret Key. The secret key is used to sign the request body with HASHAGE algorithm, the most used is HMAC SHA256. This ...
jojupiter's user avatar
2 votes
1 answer
316 views

use md5 hashed guid as app login and REST interface

We are planning to use a md5 hash of a user guid to confirm access to a GET, POST, PUSH, DELETE rest - api. All communication is over a secured https channel. The REST api is programmed to resist XSS ...
theking2's user avatar
  • 146
0 votes
1 answer
218 views

Impact of setting allowUrlEncodedPercent to true in StrictHttpFirewall

I need to implement a public REST API that manipulates usernames. So I have an endpoint that looks like GET http://.../api/users/<username> where username can contain special characters (slashes,...
R. Aubel's user avatar
1 vote
0 answers
369 views

CSRF and XSS Protection with a Static Site and REST API

I'm building an application which will support both browser and application access to REST resources. Applications will POST a username/password JSON body to a login endpoint which will return a ...
Naftuli Kay's user avatar
  • 6,813
0 votes
0 answers
111 views

authentication for SDK requests to a private API

I have an API that responds to requests with a JSON that contains app updates and advertisements. Requests are sent by my SDK that is implemented inside my game. I need authentication because JSON ...
Winner1's user avatar
  • 113
1 vote
1 answer
2k views

How to implement the CSRF token mechanism for restful APIs?

Considering the following facts, using CSRF token for a restful API (which of course is intrisincly session-less) seems inevitable: storing JWT in local storage(any where other than http-only cookie) ...
Gandalf's user avatar
  • 115
0 votes
0 answers
138 views

Is using a developer key to protect a REST API good practice?

I'd like to implement a RESTful API service over HTTP that developers can call from their server side environments. I intend to use a cryptographically secure pseudo-random number generator (CSPRNG) ...
Andy Fusniak's user avatar
0 votes
1 answer
6k views

CheckMarx SSRF Vulnerability

I have a REST which takes a parameter dataSource as input and myService has follow logic. @RequestMapping(value ="/save", method = RequestMethod.POST) public List<String> find(@...
Artem Fedin's user avatar
0 votes
1 answer
3k views

Cookies Vs Headers For REST API User Authentication Token

I'm working on a small rest api project with user authentication. But I'm wondering whether I should store the users authentication token in a header or a cookie. The general idea is as follows: User ...
Bryan's user avatar
  • 3
0 votes
1 answer
217 views

Is it possible to avoid exposing the fact that an e-mail address is used by a web application (API) while still ensuring a decent UX?

One of the raised issues for a Web API is that for an e-mail based authentication (e-mail and password) the Register user method returns something like "the registration e-mail has been sent"...
Alexei's user avatar
  • 2,193
0 votes
3 answers
342 views

Security issues of exposing CRUD operations through a single API endpoint?

Imagine an API where all CRUD operations are done through the same POST HTTP Request but with different "action" values from request body. { "action":"[create|read|update|...
discordia28's user avatar
2 votes
1 answer
1k views

OWASP Pentest - "Sensitive data sent in clear text" [closed]

We have our web app / REST API getting tested by potential customer. In the report they came up with this issue: Sensitive data like user credentials on login page, password reset, change password ...
PeS's user avatar
  • 131
1 vote
0 answers
291 views

Is masking JWT custom claims a good practice?

We use JWT tokens in our Rest API(Bank API) authentication with a normal payload like: { "user_id": "cdda338f-50e2-4e14-9f84-33b8a158db9f", "tenant_id": "...
Felipe Emerim's user avatar
0 votes
0 answers
127 views

How to authenticate OAuth2 confidential client is making a REST call?

We are looking to implement some REST services to be called from partner servers (not end users via a browser). The out-of-the-box implementation seems to flow thusly: Partner server passes a client ...
Matthew McPeak's user avatar
2 votes
1 answer
749 views

Can one send data securely to a REST API endpoint

Say I have an endpoint to create a username: https://example.com/api/create_user/foo/1234/ or https://example.com/api/create_user/?name=foo&token=1234 Where username = foo and the api token is ...
run_the_race's user avatar
1 vote
0 answers
751 views

Basic authentication after mTLS?

I work for a software company and I'm currently doing research for an enhancement request. Essentially we have a application client which talks to a rest end point which is authenticated using basic ...
Errol Neal's user avatar
2 votes
2 answers
322 views

Access Control for REST APIs - OWASP recommendation

OWASP states: Non-public REST services must perform access control at each API endpoint. Web services in monolithic applications implement this by means of user authentication, authorisation logic ...
Eduardo Bueno's user avatar
0 votes
0 answers
628 views

Best secure approach with Basic Auth

Due to several customer reasons our product needs to support Basic Auth as primary authentication mechanism with client's service account. We are using Bcrypt to store customer's password in our DB, ...
Kucera.Jan.CZ's user avatar
1 vote
1 answer
2k views

REST API is protected by HMAC based authentication. What does including URL path in the message protect from?

I have came across a REST API for some commercial software, that checks authentication by requiring HMAC on concatenation of http_method (GET, PUT, etc) timestamp payload (body of a POST / PUT ...
Andrew Savinykh's user avatar
0 votes
0 answers
1k views

JWT token. Send in a cookie or Auth header depending on Rest vs MVC?

Reading around I gather that for a Restful API since you don't use cookies,then you send the token in the Auth header.Correct so far? When on a traditional MVC app ,do you send the token inside a ...
microwth's user avatar
  • 2,483
0 votes
1 answer
308 views

Replace hashed password by public key generated from password

I don't like my server having access to plaintext passwords. Instead of SRP, OPAQUE or another PAKE that needs several rounds, I was thinking I could take the username, server url and password, run a ...
Bruno Martinez's user avatar
2 votes
1 answer
214 views

Authentication for website and mobile app

This doing a Spring Boot application (Rest API, JPA, etc) uses (via Rest) from a website (Angular) and a mobile app (Android). The user using the mobile app (in the future) will be able to ...
TheStuck's user avatar
0 votes
2 answers
243 views

Reject requests from our tampered android apps

I'm working on an Android application with few millions of users. The app has some financial|payment features. We have some public APIs and some authenticated ones (OAuth2). As a part of enhancing our ...
Alireza Farahani's user avatar
2 votes
3 answers
339 views

How can I prevent API bot automation by a legitimate user?

My web application is a long sequence of games, which submit progress results back to the server via a web API. These progress messages are how we know how many points the user has earned. The points ...
Joshua Frank's user avatar
2 votes
2 answers
1k views

How could a server to server rest api communication be more secure, by using OAuth 2?

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my ...
Iter Ator's user avatar
  • 193
0 votes
2 answers
757 views

API key safety in front end app running in localhost

I have been working on a front end (React) app that sends REST requests to an API end point. I am aware that sensitive items such as API keys should not be stored in front end frameworks (like React, ...
u9kV-6J's user avatar
  • 145
0 votes
1 answer
257 views

RestApi Libsodium SealedBox end-to-end request encryption scheme

I am making an API that uses the following steps for encryption. All of this is implemented using libsodium. First of all the client has to make an initial request to the server for getting his public ...
Leonel Franchelli's user avatar
0 votes
1 answer
119 views

Are there any identity providers which support securing RESTful interfaces using digital signature?

I would like to use digital signatures to secure access to a RESTful API, exactly as described here under "Message signing using Digital Signature". Extract: When signing, the sender uses ...
Stephen Hartley's user avatar
3 votes
1 answer
1k views

What else can be used instead of an API Key to protect resources in a REST API as is implied by OWASP?

I was reading the OWASP Cheat Sheet Series, specifically their cheat sheet for REST Security and one of the points they had under the section for API Keys was: Do not rely exclusively on API keys to ...
Script47's user avatar
  • 227
1 vote
1 answer
2k views

Secure REST API for mobile and web application usage

I have been reading about authentication and authorization for the past few days and I still have not figured out what would be a reasonable way to deal with this for both mobile and web applications. ...
dsax7's user avatar
  • 111
0 votes
1 answer
182 views

Secure a REST API

I want to build a REST API where applications can authenticate using an OAuth2 Bearer Token, so they get access only to resources related to one user or they can access by itself accessing resources ...
Nightloewe's user avatar
29 votes
6 answers
7k views

Is splitting a REST API server from a Web server considered a security threat?

I am participating in a project that involves a JavaScript SPA that provides a service and is intended to interact via REST APIs with one of our servers. Initially, I proposed to work on the two ...
Acsor's user avatar
  • 401

1
2 3 4 5
8