Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

38 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
93 views

Cross Origin Resource Sharing question

I have some mockup html/javascript on my desktop, I made an ajax GET call to: http://www.bungie.net/platform/Destiny/TigerPSN/Account/4611686018429149347/Character/2305843009215132906/Activities/ ...
4
votes
0answers
1k views

Safe communication via rest api between two known servers

I'm using Kinvey as backend but because it doesn't provide the ability to run custom code I have set up another server. So basically when x happens on Kinvey server, I send a call to my rest api on ...
3
votes
1answer
2k views

Securing REST API for use by mobile apps

I developed a REST API whose clients are mobile apps/websites under my control (API is not open to anyone). Users log into my mobile app/website with their Facebook or g+ login. I'd like to secure ...
2
votes
1answer
249 views

Security of Publicly exposed REST APIs

We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple ...
2
votes
0answers
47 views

Securing an error-reporting API against spamming

We are planning/spec'ing a REST API for communication with an iOS app an external team is building. For most calls, the API key hardcoded into the application and a session ID produced on our side ...
2
votes
0answers
1k views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
2
votes
0answers
1k views

Security instructions for a mobile banking REST API

I am designing a .NET Web API-based REST API that would be accessed via a mobile banking-like app. We plan to use OAuth 2.0 Resource Owner flow for authorization. All requests will go through HTTPS ...
1
vote
0answers
57 views

Security aspect in the API gateway area

I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level. Scanning REST APIs (see http://docs.w3af....
1
vote
2answers
56 views

Security considerations of consuming public API

I have a website and i want to consume public API from third party services such as Zoopla, weather etc. I want to ensure i do not consume malicious code/malware from the data retrieved from the 3rd ...
1
vote
0answers
49 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
1
vote
0answers
73 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
1
vote
0answers
149 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
1
vote
0answers
51 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
1
vote
0answers
87 views

Restrict Public API To Access From Single App

I have a REST api on a server and an application for android phones that mostly makes calls to that api and presents the info to the user. Because the application needs to be a quick way to lookup ...
1
vote
0answers
2k views

How website hide api response?

I build a web application and get data via REST API. eg: https://mywebapi.com/product/{productId} then I get json response and use the json data response in my web page https://myweb.com/product/{...
1
vote
0answers
35 views

securing a REST end point for 3rd part applications to connect to

Im generating a REST database service for an android application to connect to, and have little to no security experience. the service currently uses OAuth2 to secure a web front end with a Spring ...
1
vote
0answers
80 views

How to safely generate and store a password out of Google OAuth user data (for another REST API)

I have a web app, where users sign in with Google (OAuth 2.0). This web app uses a REST API (figo.io) in the background, so I have to create an API user with credentials. Now I have the following ...
1
vote
0answers
41 views

Securing promotional discounts

I have a service, offering a physical good in exchange for either money or via code given out by us. The service is accessed through a mobile application. The codes have usage restrictions, for ...
1
vote
0answers
84 views

How to authorize users for rest service

me and my friend are doing a project for a company. It involves getting some information from the database and display it on a smartglass device (epson, sony, ...). Now we want to build a RESTful ...
1
vote
0answers
3k views

Codeigniter RESTful web api creation for mobile and web applications general guidelines

I'm having application with running good in codeigniter, mysql and jquery. Currently we are planning to evaluate our web application with mobile application. So we planned to develop web application, ...
1
vote
0answers
909 views

Secure Single Page Application (SPA) served from a CDN

Is it possible to secure a Single Page Application (SPA) served from a CDN that communicates with a REST API, assuming the following: The front end communicates with a backend REST API using a token ...
1
vote
0answers
428 views

Securing RESTFul WebServices

I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL. The Userid / Password is encrypted and sent to Web Application hosting the REST WS where ...
1
vote
0answers
811 views

I authenticate my users through Facebook's Oauth client and want to secure my own called APIs

My application is divised into two parts: Javascript application as client Server side API's (RESTFUL through Play!2.2 framework) I expect users to be authenticated through Facebook's Oauth 2.0 ...
1
vote
0answers
765 views

Preventing access to my public REST api from my trusted client application

I own a set of REST APIs and some of them don't require users to be authenticated. Example could be: api/items/index of an e-commerce". Currently, I use Cookie-based tokens from my application, but ...
1
vote
0answers
607 views

Generating API keys within an OAuth2 session for non-web-browser clients

I am using Google's OAuth2 for authentication for a website which also has a RESTful API component. I would like to support connections from clients which are not within a web browser. Also, I'd ...
0
votes
0answers
33 views

Public report/telemetry API

I want to implement a telemetry data sender into my electron app. The API which I want to connect to is public. So any crash reports or any other data from the user is sent to it. The problem is how ...
0
votes
0answers
56 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
0
votes
0answers
38 views

REST API Basic Authentication Use Case

I'm developing REST APIs and would like to know if Basic Authentication will be enough to secure them, or if I should be looking into other authentication methods, like OAuth2. My APIs are setup to ...
0
votes
0answers
41 views

what would be the best approach to generate JWT token for server to server communications?

I am planning to develop an authentication service which generates and validates the JWT token for incoming requests. What would be the best challenge mechanism which could be employed to generate the ...
0
votes
0answers
37 views

Does an OAuth1.0a HTTP GET endpoint in my API present a security vulnerability?

I'm building a hobby application, and I'd prefer it not end up on a cyber-security expert's list of insecure sites. My application can post to Twitter on behalf of a user. This required implementing ...
0
votes
0answers
52 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
0answers
18 views

Restrict RESTful Routes to Authorized Clients

I am building an application that stores form entries. It will accept post requests from a client web application and store the information as defined in the request. For example, frontend.com makes a ...
0
votes
0answers
184 views

Exposing protected API without hardcoding credentials in the Client (JS)

Try to expose protected REST API without exposing credentials in the Client (JS Code). All solutions that come to my mind, can be reversed and the Attacker can reconstruct them. Are there any ...
0
votes
1answer
478 views

Content-Type for a JWE Compact Serialization payload

The scenario is that the same code library is used by both client and server to encrypt/decrypt messages. The server application uses the library's encryption function to encrypt some content (that ...
0
votes
0answers
119 views

Arduino/ATMega calling HTTPS REST services

Background I am working on an IoT project where we are using ATMega Micro Controllers as end devices. These devices need to communicate with REST services and post some sensitive data. The REST ...
0
votes
0answers
2k views

Secure REST API using Public/Private keys?

I was having a conversation with some programmer friends about securing an API without server modification. Only SFTP access to the filesystem is allowed and OpenSSL extension is installed, the admin ...
0
votes
0answers
332 views

OAuth - Facebook custom authorization grant

I've developed my own custom authorization grant. The steps I am undertaking are the following: I get the facebook authorization code from the mobile device (this is an an API for mobile devices) I ...
0
votes
1answer
154 views

Designing and implementing a secure epayments system with RESTful API

I want to design and implement an epayments system (I will not be handling credit card payments). The system will have a RESTful API. I am already familiar with RESTful servies, and have built a few ...