Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
The results are in! See what nearly 90,000 developers picked as their most loved, dreaded, and desired coding languages and more in the 2019 Developer Survey.

Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

1
vote
1answer
77 views

Should I report this Google API key disclosure issue or not?

I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to: https://www.googleapis.com/customsearch/v1/...
0
votes
0answers
26 views

Does an OAuth1.0a HTTP GET endpoint in my API present a security vulnerability?

I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites. My application can post to Twitter on behalf of a user. This required implementing ...
1
vote
0answers
25 views

Securing Rest API content using .Net Identity Framework [migrated]

Can anyone provide direction on how to add a Rest API to an existing Azure .net website as an alternative to receive private information? Like many website, we already have good U&P authentication ...
1
vote
1answer
37 views

No put/delete in API, parametrized query, sanitized user input - enough for API security

If my Restful Flask API doesn't need user login, then are the following features enough for the API security: There is only a get method in my API, no put/delete methods. Queries are parametrized ...
1
vote
1answer
81 views

Why is PKCE secure against man-in-the-middle attacks?

In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
0
votes
0answers
42 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
1answer
37 views

Secure Exchange Rate for Restful API

I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another ...
-1
votes
1answer
48 views

How do I detect spoofed REST API responses in my webapp?

I am building an internal admin panel for my team that will communicate to the backend server using a REST API. One of the API calls that will be performed will be an "authorization check" where the ...
0
votes
0answers
25 views

Node.js Cookies/Tokens (Access & Refresh) - OAUTH2 - How to store tokens and time/function refreshing

1) I am currently building a RESTful API which acts as a middleman between clients and an authentication server. A client gives me some account details and my server passes them to the auth server who ...
0
votes
0answers
17 views

Restrict RESTful Routes to Authorized Clients

I am building an application that stores form entries. It will accept post requests from a client web application and store the information as defined in the request. For example, frontend.com makes a ...
2
votes
1answer
81 views

Unauthorized API Access Without Key Header

In order to test the security of my API, I want to act as sort of an attacker in order to try and gain access to my own API without an API key. In order for me to send requests to this endpoint, I ...
0
votes
1answer
94 views

Is IP whitelisting safe enough for a HTTP Basic protected service available on the internet?

We are discussing about making available through the internet one of our microservices deployed on a public cloud on Kubernetes. This ms offers some sensitive information to the clients. This ...
1
vote
0answers
34 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
13
votes
3answers
2k views

Why should someone block all methods other than GET and POST in a RESTful application?

TL;DR: Is there a valid reason to demand a software vendor to stop using HTTP PUT and DELETE methods in a web application and use only GET and POST? The application uses frameworks to whitelist ...
0
votes
0answers
52 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
0
votes
1answer
314 views

What all test cases/vulnerabilities we need to try in REST API Pen testing?

I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API. I have gone through the OWASP resources ...
0
votes
2answers
64 views

How can I secure a REST service intended to be used by my customers' customers via their public website?

I am developing a service with an associated REST API for customers (companies which have their own websites) to use. In other words, one of my customers would typically make the REST call directly ...
2
votes
2answers
109 views

Sensitive data enumeration via HTTP error codes

Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user Bob a message to his cell phone which he registered on our ...
1
vote
0answers
46 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
4
votes
2answers
128 views

Deal with API Webhooks that refuses authenticating itself

I'm currently in the process of writing a connector to an API. It's for an automated shipping system and I'm required to listen to events from that given API, sent via Webhooks. The API owner does ...
0
votes
0answers
90 views

Exposing protected API without hardcoding credentials in the Client (JS)

Try to expose protected REST API without exposing credentials in the Client (JS Code). All solutions that come to my mind, can be reversed and the Attacker can reconstruct them. Are there any ...
2
votes
4answers
147 views

Are there any reasons to add payload signature to a rest API with mutual TLS?

We have a B2B Rest API with Client Certificate authentication. Are there any reasons to add also a payload signature check to this API? I'm seeing many service providers which add a digital signature ...
0
votes
2answers
716 views

CSRF Origin and Referer Header just check host?

Note: This question is not the same as the linked possible duplicate. That question asks how checking the origin/referer header protects against CSRF. This questions is asking how to implement the ...
0
votes
0answers
82 views

Machine Learning based application vulnerability scoring

This question is related to an earlier questions: 1 & 2 about the limitations in web application vulnerability scoring/automated vulnerability scoring. Indeed, scoring vulnerabilities detected in ...
1
vote
1answer
427 views

Hash a secret API key with a random salt instead of sending sending it alone in REST API

Say, I have an internal https API endpoint used only by me being the admin. In each each request I send a secret API key for authentication. And I'm fine with this solution. curl -x PUT ....... -...
2
votes
1answer
2k views

A simplistic stateless alternative to HTTP basic auth for API's

Many API's (services) today use OAuth, HTTP Basic Authentication or API keys to authenticate their users. My goal is to find a simplistic secure way to authenticate users in a client-side ...
5
votes
2answers
411 views

Is it safe to use a stateless authorization mechanism where the clear password is stored on the keychain?

Is it safe to use the following stateless authorization mechanism between a client (iOS & Android) and server? Sign up The client provides an email and password and saves the clear password on ...
-2
votes
2answers
301 views

Using AES CBC PKCS5PADDING for REST API?

I am planning to use AES CBC PKCS5PADDING with a passphrase to encrypt my REST API traffic to POST/GET over HTTPS from an Android application. the scope is to protect user data from MITM attacks and ...
4
votes
1answer
75 views

How is this registration setup vulnerable?

I'm developing a mobile app for iOS and Android that has, due to specs that are given by management, some security flaws. However, I can't quite explain in concrete business speak why the specs are ...
0
votes
0answers
135 views

Securing mobile app API Using UDID and Argon2

I'm trying to build an iOS app, I have wrote the code and all, and now I am implementing the APIs to communicate with the database. The app will be using HTTPS and POST Requests to communicate with ...
1
vote
0answers
63 views

Restrict Public API To Access From Single App

I have a REST api on a server and an application for android phones that mostly makes calls to that api and presents the info to the user. Because the application needs to be a quick way to lookup ...
2
votes
2answers
125 views

Security on a REST Api used from a JS

I am developing an application where I provide a JavaScript to my clients (stored on my CDN), and they can load it to their web pages via script tag. This JavaScript does some checks on the DOM and ...
2
votes
1answer
411 views

SSL certificate for WebAPI

We have a simple system with a REST service (WebAPI) that will be hosted on one machine (hosted on IIS on a custom port, port numer 3031) and with a website hosted on another machine that will be ...
0
votes
0answers
29 views

Rest service Password securing [duplicate]

I have a REST service A, which communicates with REST service B (both are internally hosted within the company network). REST service B is accessed via a service ID & plain password. How do I ...
1
vote
1answer
194 views

Why using oAuth2 refresh token is more secure then regenerate an access_token?

I'm implementing an oAuth2 authentification to secure my REST Api. As I am implementing oAuth2, I need to generate an access_token which will give me a temporary access to my REST datas. To do it, I ...
0
votes
1answer
78 views

Authentication in RestAPI

I want to implement a security mechanism by which i can secure my RestApi from the "Clients who are not what they claim to be". In my case the consumer of API for now is another web service not ...
43
votes
10answers
20k views

Is it more secure to program a client-server system in a language other than English?

I'm developing a system with communication via REST between front (JavaScript) and back end (Java/Spring) and this question popped up. Does it makes this system more secure to name variables, URLs, ...
0
votes
1answer
941 views

How I can enumerate all endpoints of an API?

Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?
3
votes
2answers
123 views

Is switching protocols a security measure worth implementing?

We deploy our internet facing applications in multiple vlans and there is a rule that talking from one vlan to the next has to be done in another protocol or an other implementation of the protocol. ...
27
votes
3answers
6k views

Generating one time URLs which can be revoked

I have a requirement to generate a one time use URL which should have the following features: As the URL query parameters may contain sensitive information, it should be encrypted (on top of https ...
2
votes
2answers
187 views

Security of Publicly exposed REST APIs

We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple ...
1
vote
0answers
234 views

tool with rest api to scan base64 encoded files [closed]

I'm searching for a tool (antimalware / antivirus) that exposes a REST API and accept me to pass a base64 encoded file in order to check if it's a malicious one or not. I've tried the ClaimAV but it ...
1
vote
4answers
795 views

How to prevent self-XSS?

I am creating a website which solely uses REST api for all the features and functionality, from signup and login to fetching data and populating the webpage using Mustache as template engine for ...
6
votes
1answer
9k views

Store Auth-Token in Cookie or Header?

I do understand that a header is the "cleaner" solution to transport an auth-token from a trusted system to another in a REST call. But when you are in client-side JavaScript code, the world looks ...
4
votes
2answers
4k views

Do I need to hash or encrypt API keys before storing them in a database?

I'm securing API calls to a REST service I'm building using API Keys. The plan is to: When we get a new client, generate an API Key (a UUID). Email the API key to them. They send the API key on every ...
1
vote
1answer
879 views

Store splitted JWT for CSRF protection and refresh strategy

I've been reading a lot about stateless authentication systems, and I want to implement something with JWT for the first time, but now I'm concerned about how to properly (and securely) consume a ...
0
votes
2answers
89 views

Secure way to send files to server, store, then retrieve

I am looking for ideas today. The problem: Sensitive files are sent via REST (over SSL, of course) to a third-party server. I cannot touch them programmatically until they arrive at the server. Those ...
3
votes
1answer
1k views

Secure RESTful api communication between multiple servers

Currently I have the following design: Central cloud hosted server with a REST api Multiple remote servers each with a REST api Data is posted from the remote servers to the central server at ...
1
vote
1answer
93 views

Best way to secure local REST server?

Currently I have a raspberry pi connected to my home security system. I have written a Python daemon running a HTTP server (very insecure I know, but this is still under construction) so I can send it ...
-1
votes
1answer
76 views

Is there any reason to use an encrypted value for the plain text signing key?

I am creating an API and I am thinking of using an encrypted value of some random password as the value to store for the plain text representation of my signing key. Is this just a vain attempt to ...