Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

Filter by
Sorted by
Tagged with
0
votes
0answers
57 views

How to secure API used by third-parties?

What I am building is service that can be consumed by third-party. Something like Omdb API for example. For my service to be functional I needed to disable CSRF on some endpoints. How can I secure ...
0
votes
2answers
86 views

Is it safe to publish a REST API client on npm even though the API is not intended for public use?

I am build a website in Angular which communicates over my REST API on my backend server. I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on ...
3
votes
1answer
93 views

How to secure REST API for parameter manipulation?

I am developing secure payment APIs, i want to avoid manipulation of API parameters and fired same API again. For example, following is the API call https://api.payment.com/wallet/transfer?...
1
vote
1answer
51 views

How to ensure JWT security in authentication?

I have implemented a backend as a REST API. To maintain the statelessness in REST, I intend to use JWT to verify that that a user has logged in or not. (A user is logged in if a valid token is present ...
1
vote
1answer
70 views

Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?

I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
17
votes
5answers
6k views

Why should someone block all methods other than GET and POST in a RESTful application?

TL;DR: Is there a valid reason to demand a software vendor to stop using HTTP PUT and DELETE methods in a web application and use only GET and POST? The application uses frameworks to whitelist ...
0
votes
2answers
72 views

Angular (2+) code visibility to users

I'm looking into Angular and read that typescript is compiled to javascript. Is everything viewable/visible to users that I write using typescript? With PHP I know you run code that's only visible to ...
1
vote
0answers
2k views

How website hide api response?

I build a web application and get data via REST API. eg: https://mywebapi.com/product/{productId} then I get json response and use the json data response in my web page https://myweb.com/product/{...
142
votes
6answers
67k views

Should I use CSRF protection on Rest API endpoints?

Quick note: this is not a duplicate of CSRF protection with custom headers (and without validating token) despite some overlap. That post discusses how to perform CSRF protection on Rest endpoints ...
3
votes
2answers
125 views

Is this security scheme using passwords, short-lived access JWTs, and long-lived refresh tokens a good way to secure a REST API?

I'm trying to secure a REST API that I'm using as a backend for a single-page application. The API provides access to read/create/modify/delete protected resources, based on a set of permissions ...
1
vote
1answer
300 views

How to invalidate JWT tokens without a database lookup with each request to the server?

JWT Bearer token and stateless REST API question I am implementing a stateless REST API. I am used to using sessions built into frameworks or 0Auth but now I am in the process of developing my own ...
1
vote
0answers
65 views

Is it possible to get hacked by a redirection placed inside a Facebook Graph URL?

Basically, I have a webapp which needs to check the validity of the user of an Android app. After completing the basic login flow with Facebook in the Android app, a Facebook access token is sent to ...
1
vote
1answer
57 views

Security Risk of outbound web calls [closed]

What possible risks/attack vectors could be introduced be allowing my server application to make outbound calls to a 3rd party REST API? The 3rd party REST API is off premises and owned and operated ...
5
votes
4answers
115 views

Security considerations of consuming public API

I have a website and i want to consume public API from third party services such as Zoopla, weather etc. I want to ensure i do not consume malicious code/malware from the data retrieved from the 3rd ...
0
votes
2answers
98 views

Windows Account Password Resetting process for large network

I am working on large windows based network environment (Active Directory) and I have a requirement of implementing clear and secure password reset process for windows user. Especially management ...
0
votes
1answer
540 views

Content-Type for a JWE Compact Serialization payload

The scenario is that the same code library is used by both client and server to encrypt/decrypt messages. The server application uses the library's encryption function to encrypt some content (that ...
2
votes
1answer
310 views

Security of Publicly exposed REST APIs

We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple ...
1
vote
0answers
84 views

Is it safe to let users enter a URL in my app that queries an external REST api?

The idea was to allow users to enter a URL inside the application that would send a request to my backend, fetch the data, and load it into a local cache (Apollo/GraphQL). The only sensitive data sent ...
3
votes
2answers
1k views

Security on a REST Api used from a JS

I am developing an application where I provide a JavaScript to my clients (stored on my CDN), and they can load it to their web pages via a script tag. This JavaScript does some checks on the DOM and ...
0
votes
1answer
64 views

Token Based Authentication

I have a React app that connects to a REST API for which I have to implement token based authentication. The only info stored in the token is the user id. The following flow will be used: User logs ...
0
votes
1answer
53 views

Golang REST API: Security checks? [duplicate]

It's my first time building and deploying a REST API with just the standard library. Are there any gotchas I should keep an eye out for regarding securing my REST API?
1
vote
0answers
40 views

Calling Powershell script from external program passing an argument

I have an external program which calls a PowerShell script with a random secret identifier as a single argument. The PowerShell script needs to return the same random secret id when it calls the REST ...
84
votes
7answers
93k views

How do I secure my REST API?

In detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After searching with Google for a ...
33
votes
6answers
26k views

Ensure web service only accessed by authorized applications

Preface My mobile app allows users to create accounts on my service. In addition to being able to log in with external authentication providers, like Facebook, I want to give the user the option to ...
0
votes
0answers
40 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...
1
vote
1answer
120 views

Securing API access. oAuth Client Credentials vs client ID and secret

I have a REST API that will be called by other external 3rd party servers over the internet and be used only for machine to machine communication. I am looking for mechanisms to secure this API such ...
1
vote
2answers
1k views

CSRF Origin and Referer Header just check host?

Note: This question is not the same as the linked possible duplicate. That question asks how checking the origin/referer header protects against CSRF. This questions is asking how to implement the ...
1
vote
1answer
64 views

How to protect against injection into a 3rd party REST API?

I have a 3rd party API that I need to connect to and they allow queries that can be formed by changing url parameters. E.g. /data?startDate=2019-01-01 or /data?name='John Doe' It is easy to form ...
1
vote
1answer
57 views

Is using an access token for authentication a bad idea

Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
0
votes
2answers
75 views

JWT vs custom encryption for REST APIs over https

For our REST API architecture, we are currently thinking over two options - Json Web Token - pros are that it is industry standard, we pass a key which adds a layer of access control and using which ...
0
votes
0answers
72 views

How to protect API that should be accessible to everyone? [duplicate]

I have some API that should be accessible from a very long list of devices (some of them can reach my Oauth2 server and get some token, some of them cannot). These devices are mobile phones (IOS, ...
1
vote
2answers
67 views

No put/delete in API, parametrized query, sanitized user input - enough for API security

If my Restful Flask API doesn't need user login, then are the following features enough for the API security: There is only a get method in my API, no put/delete methods. Queries are parametrized ...
1
vote
0answers
69 views

Security aspect in the API gateway area

I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level. Scanning REST APIs (see http://docs.w3af....
2
votes
2answers
93 views

Does TLS have any way of exposing only the URI in a SSL-SSL proxy, or BlueCoat style appliance?

I'm writing an experimental authentication protocol and need to see the unencrypted URI's of the HTTP Call, but want to provably show that I can't see the data. Does any standard, or feature exist ...
6
votes
5answers
7k views

Hiding sensitive data in URIs

This is a potentially hypothetical question since it has not been determined whether we will be required to do this but I figure it's a question that will come up more often. Background When ...
1
vote
1answer
60 views

Secure REST API that only works for users authenticated by App with SSO (OAuth?)

I somehow need to accomplish the following: User accesses a application written in JavaScript. Application uses SSO to identify the user who is logged into Windows. Application obtains the access ...
0
votes
2answers
128 views

Rest API Security Guideline. Developer Rules? [closed]

In my current project I am also setting up the area of security testing. So far there was no way to use security within the REST API development. Beside the known approach, e.g. using static software ...
0
votes
2answers
1k views

Rest API Sensitive Data GET

We are trying to decide the best approach to designing our new interface with our consumers. Currently we are talking about an Rest API. However there is some debate among our team about how to ...
1
vote
1answer
90 views

Security and the Definition of Ready and Done [closed]

Currently I am in a project where I have to test REST APIs among other things. In another question of mine I also discussed the topics Definition of Ready and Definition of Done regarding security. ...
6
votes
2answers
40k views

Securing passwords for REST Authentication

I'm developing a REST application using the Spring Framework, as as part of the requirements, we have to secure the different functions of the system to different user roles (pretty standard stuff). ...
1
vote
0answers
55 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
0
votes
0answers
40 views

Public report/telemetry API

I want to implement a telemetry data sender into my electron app. The API which I want to connect to is public. So any crash reports or any other data from the user is sent to it. The problem is how ...
0
votes
0answers
17 views

Server to Server API Security [duplicate]

Background I have a use case where external 3rd party remote servers (which I do not own or control) are sending data using a POST request to my central server over the internet. Each of these remote ...
1
vote
0answers
60 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
2
votes
1answer
462 views

Exploitability of allowed wildcard (*) CORS Origins with Bearer Token Authorization [duplicate]

I'm looking at the following setup. A web application uses a REST API to communicate with the server. All API responses include Origin: *. For authorization Authorization: Bearer <token> is used....
2
votes
2answers
608 views

Is IP whitelisting safe enough for a HTTP Basic protected service available on the internet?

We are discussing about making available through the internet one of our microservices deployed on a public cloud on Kubernetes. This ms offers some sensitive information to the clients. This ...
0
votes
0answers
40 views

REST API Basic Authentication Use Case

I'm developing REST APIs and would like to know if Basic Authentication will be enough to secure them, or if I should be looking into other authentication methods, like OAuth2. My APIs are setup to ...
31
votes
1answer
17k views

JSON Web Tokens - How to securely store the key?

I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The conceptual core of this method is that the server is the only ...
18
votes
2answers
23k views

Store Auth-Token in Cookie or Header?

I do understand that a header is the "cleaner" solution to transport an auth-token from a trusted system to another in a REST call. But when you are in client-side JavaScript code, the world looks ...
29
votes
2answers
6k views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...

1
2 3 4 5
7