A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

Filter by
Sorted by
Tagged with
32
votes
4answers
25k views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As https://stackoverflow.com/a/15350123/14731 explains: The ...
56
votes
6answers
84k views

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET: www.mycoolsite.com/index?id=1&type=...
132
votes
5answers
61k views

Should I use CSRF protection on Rest API endpoints?

Quick note: this is not a duplicate of CSRF protection with custom headers (and without validating token) despite some overlap. That post discusses how to perform CSRF protection on Rest endpoints ...
32
votes
6answers
26k views

Ensure web service only accessed by authorized applications

Preface My mobile app allows users to create accounts on my service. In addition to being able to log in with external authentication providers, like Facebook, I want to give the user the option to ...
16
votes
3answers
8k views

Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?

Perhaps I'm being overly paranoid, but after reading recent news regarding network security I'm starting to believe that SSL isn't quite enough anymore for sensitive data transmissions. Ref: http://...
83
votes
7answers
92k views

How do I secure my REST API?

In detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After searching with Google for a ...
14
votes
1answer
22k views

Preventing XSS for REST API

I have a spring REST API and a client project. Client projects' HTML page uses jquery ajax calls to fetch data from REST API using json or xml format. My question is to avoid XSS attacks on a web page,...
16
votes
6answers
21k views

Securing an API for mobile access

I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
1
vote
2answers
324 views

Preventing malicious usage from users with access tokens

So I have a web page running a JavaScript application, and a web service that the application makes HTTP PUT requests against. The service uses access tokens to verify the user’s identity, but now I’m ...
2
votes
1answer
3k views

Exploiting CSRF PUT request

If the application uses RESTful communication, does it need to have CSRF protection for PUT and DELETE requests? As per my understanding its not possible to trigger a PUT request using JavaScript and ...
68
votes
3answers
51k views

Securing a JavaScript Single Page App with RESTful backend

I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
18
votes
2answers
14k views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
25
votes
2answers
5k views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...
14
votes
10answers
8k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
12
votes
1answer
4k views

What kind of hashing to use for storing REST API tokens in the database?

We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...
4
votes
2answers
2k views

Is HTTP Digest + MD5 still an alternative to consume my own api?

I'm reading a lot about implementing security constraints to a REST API. There are a lot of methods, some better than others for 3party applications or to consume my own API. HTTP Basic + TLS (with ...
70
votes
2answers
66k views

JSON Web Tokens (JWT) as user identification and authentication tokens

I'm implementing a REST service that requires authentication. I cannot store any per-user state (such as a randomly-generated token) because my service does not have direct access to a database, only ...
23
votes
3answers
12k views

Secure a publicly accessible REST api

We're building a public single page app in JavaScript that talks to a back-end REST service. What we want is for that REST-service to be only accessible from the single page app. Since it's a public ...
16
votes
1answer
4k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
30
votes
1answer
16k views

JSON Web Tokens - How to securely store the key?

I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The conceptual core of this method is that the server is the only ...
30
votes
3answers
26k views

Can I prevent a replay attack of my signed JWTs?

I have implemented a stateless auth over HTTP in Laravel, using JWTs. I send my username/password from the frontend. Server authenticates user, sends back a signed JWT with an expiry time. I'm using ...
19
votes
1answer
8k views

Why a symmetric key for HMAC?

I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard ...
12
votes
2answers
12k views

Secure REST API and Single Page App by using external OAuth 2 Authorization Code

I am trying to understand how to implement an OAuth 2 Authorization Code flow when having both a single page JS app and a REST API. The aim is to secure access to the REST API by offloading ...
9
votes
3answers
2k views

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
16
votes
2answers
20k views

Store Auth-Token in Cookie or Header?

I do understand that a header is the "cleaner" solution to transport an auth-token from a trusted system to another in a REST call. But when you are in client-side JavaScript code, the world looks ...
9
votes
4answers
4k views

Is CSRF possible if I don't even use cookies?

I have REST api that is using access token which is sent either in header or as url query. I don't use cookies at all. Am I still vulnerable to CSRF attacks? I know that I would if I would use ...
6
votes
2answers
1k views

Decide to REST API Security

I've developed an API. I got confused and I've been reading articles for days. Actually my question is close to these but not exact (maybe a combination of them); Securing REST API that will ...
12
votes
2answers
6k views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
4
votes
3answers
16k views

CORS & CSRF Prevention for an REST based API

I'm currently trying to wrap my head around how to prevent CSRF. My first solution was to use a token which is suggested everywhere. That would of course fix this problem: <img src="http://api....
11
votes
1answer
3k views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...
11
votes
4answers
14k views

Why do APIs use API Keys instead of Usernames?

It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
10
votes
1answer
3k views

REST API authentication with JWT and CSRF protection for SPA

I'm developing an SPA with REST back end and want to have simple token based authentication. The goal for REST backed is to be stateless. I will explain the security model and try to reference all ...
6
votes
2answers
3k views

Security drawbacks for using short-lived access token in javascript client side

I intend to build a front end site entirely in javascript (NodeJS) and i would like to do ajax calls to a REST WS which is on another domain on client side. I intend to use oauth2 and SSL to secure ...
6
votes
3answers
1k views

Vulnerabilities with DB backed session tokens

A user logs in and is given a session token. This token is also stored in a database on the server. The user includes this secret token with each request, and the server will pull it from the DB to ...
5
votes
5answers
6k views

Hiding sensitive data in URIs

This is a potentially hypothetical question since it has not been determined whether we will be required to do this but I figure it's a question that will come up more often. Background When ...
0
votes
1answer
2k views

advantages of http basic authentication over token-based (e.g. oauth2)?

I am interested in the question if there are any possible advantages to securing a given REST API for web clients and mobile apps with http basic authentication (over https of course) over a token-...
2
votes
1answer
3k views

CSRF and JSON APIs

I was searching for an CSRF implementation for Express.js, and i found something that get my atention, in this post it says that a JSON API is nos vulnerable to CRSF attacks... is that correct?? is ...
6
votes
2answers
7k views

Do I need to hash or encrypt API keys before storing them in a database?

I'm securing API calls to a REST service I'm building using API Keys. The plan is to: When we get a new client, generate an API Key (a UUID). Email the API key to them. They send the API key on every ...
3
votes
1answer
3k views

RESTful API URLs and Denial Of Service attacks

I overheard the following statement today: We shouldn't use /api (e.g. in a RESTful URL like /api/v1/users/get) in our RESTful URLs anymore because it makes it easier for people to Denial Of ...
3
votes
1answer
83 views

Is this security scheme using passwords, short-lived access JWTs, and long-lived refresh tokens a good way to secure a REST API?

I'm trying to secure a REST API that I'm using as a backend for a single-page application. The API provides access to read/create/modify/delete protected resources, based on a set of permissions ...
3
votes
2answers
12k views

REST security standards

As far as I know, SOAP services have security standards recognized by OASIS and W3C, such as: XML-Encryption XML-Signature SAML Are there any security standards for RESTful services?
2
votes
1answer
3k views

Securely store password for Java Keystore

Background I am implementing set of Micro services using Java spring MVC and hosted in Undertow containers using Gradle. I am using a Java keystore to secure my keys which are using by the service to ...
2
votes
1answer
354 views

Secure no-login REST API for very few clients

I'm designing a very simple data collection device for a research project. Because we are logging, among other stuff, the GPS position of actual vehicles, we need to protect the data. Since we ...
0
votes
0answers
53 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...