Skip to main content

Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

Filter by
Sorted by
Tagged with
273 votes
7 answers
183k views

Should I use CSRF protection on Rest API endpoints?

Quick note: this is not a duplicate of CSRF protection with custom headers (and without validating token) despite some overlap. That post discusses how to perform CSRF protection on Rest endpoints ...
Conor Mancone's user avatar
89 votes
7 answers
98k views

How do I secure my REST API?

In detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After searching with Google for a ...
noob Mama's user avatar
  • 993
73 votes
2 answers
67k views

JSON Web Tokens (JWT) as user identification and authentication tokens

I'm implementing a REST service that requires authentication. I cannot store any per-user state (such as a randomly-generated token) because my service does not have direct access to a database, only ...
imgx64's user avatar
  • 1,380
72 votes
3 answers
52k views

Securing a JavaScript Single Page App with RESTful backend

I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
Jon Wingfield's user avatar
68 votes
2 answers
18k views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...
TommyBs's user avatar
  • 817
65 votes
6 answers
101k views

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET: www.mycoolsite.com/index?id=1&type=...
TomJ's user avatar
  • 753
44 votes
3 answers
63k views

Store Auth-Token in Cookie or Header?

I do understand that a header is the "cleaner" solution to transport an auth-token from a trusted system to another in a REST call. But when you are in client-side JavaScript code, the world looks ...
rdmueller's user avatar
  • 2,773
44 votes
4 answers
40k views

Can I prevent a replay attack of my signed JWTs?

I have implemented a stateless auth over HTTP in Laravel, using JWTs. I send my username/password from the frontend. Server authenticates user, sends back a signed JWT with an expiry time. I'm using ...
Aditya M P's user avatar
42 votes
10 answers
20k views

Is it more secure to program a client-server system in a language other than English?

I'm developing a system with communication via REST between front (JavaScript) and back end (Java/Spring) and this question popped up. Does it makes this system more secure to name variables, URLs, ...
GuiRitter's user avatar
  • 555
40 votes
11 answers
12k views

Returning the wrong HTTP response code on purpose?

I'm writing a simple REST API, and I want to restrict access to my mobile-client only. In other words, I'm trying to prevent a malicious user from e.g. using curl to make an unauthorized POST request. ...
Miles's user avatar
  • 511
36 votes
6 answers
27k views

Ensure web service only accessed by authorized applications

Preface My mobile app allows users to create accounts on my service. In addition to being able to log in with external authentication providers, like Facebook, I want to give the user the option to ...
sbsmith's user avatar
  • 463
35 votes
4 answers
31k views

How to protect against login CSRF?

http://seclab.stanford.edu/websec/csrf/csrf.pdf points out that most CSRF protection mechanisms fail to protect login forms. As https://stackoverflow.com/a/15350123/14731 explains: The ...
Gili's user avatar
  • 2,169
34 votes
1 answer
22k views

JSON Web Tokens - How to securely store the key?

I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The conceptual core of this method is that the server is the only ...
nmomn's user avatar
  • 443
32 votes
8 answers
9k views

Is there a way to prevent someone from making his own client app for my webservice? [duplicate]

Say I have a RESTful web service and a commercial Android app on the front end which is used to interact with it. I may use SSL so that the endpoints are not visible, but someone could still do some ...
Ana Mandic's user avatar
31 votes
3 answers
28k views

Is HTTPS and Basic Authentication secure enough for banking webservices (RESTful)?

I have been reading about SSL/TLS for the last few days and looks like it has never been practically cracked. Given SSL/TLS is used for all communications between client application and the server, ...
dnang's user avatar
  • 675
31 votes
3 answers
19k views

Secure a publicly accessible REST api

We're building a public single page app in JavaScript that talks to a back-end REST service. What we want is for that REST-service to be only accessible from the single page app. Since it's a public ...
Kenneth's user avatar
  • 413
30 votes
3 answers
17k views

Generating one time URLs which can be revoked

I have a requirement to generate a one time use URL which should have the following features: As the URL query parameters may contain sensitive information, it should be encrypted (on top of https ...
Rao Nagaraj's user avatar
29 votes
6 answers
7k views

Is splitting a REST API server from a Web server considered a security threat?

I am participating in a project that involves a JavaScript SPA that provides a service and is intended to interact via REST APIs with one of our servers. Initially, I proposed to work on the two ...
Acsor's user avatar
  • 401
26 votes
1 answer
12k views

What kind of hashing to use for storing REST API tokens in the database?

We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...
maniciam's user avatar
  • 363
24 votes
1 answer
13k views

Why a symmetric key for HMAC?

I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard ...
user25231's user avatar
  • 243
23 votes
8 answers
8k views

Protect API from being tampered?

I'm building an API with websocket that serializes data through JSON. The App itself is a chat application. I came up with the following structure to send my data: {date: '2020-05-31', time: '14:28:...
VladiC4T's user avatar
  • 389
23 votes
1 answer
34k views

How do you pen test a REST API?

We have a server that is running a REST API on port 443. I'd like to make sure it's secure by doing various pen tests on it. I'm used to doing offensive testing on a webpage where I can see code, and ...
MagnificentMaleficent's user avatar
23 votes
3 answers
23k views

Best practices on securely storing access tokens

What would be the best practices for storing access tokens of another api for your users? In particular I'm developing an application with some friends that let's user log into Facebook to both ...
Joren Van Severen's user avatar
22 votes
5 answers
15k views

Compromised JSON Web Token (JWT) Bearer Token

We are implementing a REST service that requires authentication and authorization. Because of the stateless nature of REST API's, we want to use JWT to make authenticated calls to the API through a ...
BausNauf's user avatar
  • 321
20 votes
4 answers
12k views

Is CSRF possible if I don't even use cookies?

I have REST api that is using access token which is sent either in header or as url query. I don't use cookies at all. Am I still vulnerable to CSRF attacks? I know that I would if I would use ...
sed's user avatar
  • 363
20 votes
2 answers
25k views

Where should I store OAuth2 access tokens?

I am building a REST API back-end for a mobile application. In our design choice we decided to let OAuth2 providers handle the login security; however, I am not sure what the best practice is for the ...
Daniel's user avatar
  • 301
19 votes
5 answers
18k views

Why should someone block all methods other than GET and POST in a RESTful application?

TL;DR: Is there a valid reason to demand a software vendor to stop using HTTP PUT and DELETE methods in a web application and use only GET and POST? The application uses frameworks to whitelist ...
usr-local-ΕΨΗΕΛΩΝ's user avatar
18 votes
1 answer
5k views

Does it make sense to implement OAuth when no 3rd party is involved

I own a REST API at server side and a distinct web application that would call those APIs. I want to secure my APIs calls. After some reading, I want to implement the OAuth 1.0a mechanism at server ...
Mik378's user avatar
  • 431
18 votes
3 answers
10k views

Securing a multi-tenant, multi-database REST API

I am looking to improve the security of an existing REST API accessed over SSL. The web service is multi-tenant, such that each tenant has an assigned TenantId. The problem I facing can be summarized ...
Rebecca's user avatar
  • 283
18 votes
1 answer
6k views

Best way to secure javascript front end/REST back end architecture web site?

I would like to build the following project: public REST API back end which can be accessed by any authenticated client. front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
rico's user avatar
  • 361
17 votes
1 answer
29k views

Preventing XSS for REST API

I have a spring REST API and a client project. Client projects' HTML page uses jquery ajax calls to fetch data from REST API using json or xml format. My question is to avoid XSS attacks on a web page,...
MShah's user avatar
  • 281
16 votes
3 answers
9k views

Is SSL secure enough for a REST API - has anyone used PGP or AES to encrypt the actual data inside SSL?

Perhaps I'm being overly paranoid, but after reading recent news regarding network security I'm starting to believe that SSL isn't quite enough anymore for sensitive data transmissions. Ref: http://...
Steve's user avatar
  • 169
16 votes
1 answer
4k views

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
Stefany's user avatar
  • 1,287
16 votes
2 answers
8k views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
rita potter's user avatar
16 votes
6 answers
22k views

Securing an API for mobile access

I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
Tal Weiss's user avatar
  • 303
16 votes
1 answer
6k views

REST API authentication with JWT and CSRF protection for SPA

I'm developing an SPA with REST back end and want to have simple token based authentication. The goal for REST backed is to be stateless. I will explain the security model and try to reference all ...
Marko Vodopija's user avatar
15 votes
2 answers
34k views

Do I need to hash or encrypt API keys before storing them in a database?

I'm securing API calls to a REST service I'm building using API Keys. The plan is to: When we get a new client, generate an API Key (a UUID). Email the API key to them. They send the API key on every ...
Daniel Hipke's user avatar
15 votes
1 answer
22k views

Security for REST api (user/pass auth vs hmac vs oauth)

I have two servers (one on Hetzner (I am calling it H) and other in my office (calling it O) ). I need to run a basic CRUD web service on O and the only consumer of the service is H. Data on O is ...
Abhinav Kaushik's user avatar
15 votes
2 answers
5k views

Is request signing (digesting the request body) in a REST API necessary?

I am currently engaged in a debate and I wondered what the community's opinion on this was. We see REST APIs which just require basic authentication (perhaps HTTP) or OAuth. We see REST APIs which ...
Jamie Edwards's user avatar
14 votes
10 answers
11k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
u9kV-6J's user avatar
  • 145
13 votes
2 answers
22k views

JWT token login and logout

Hi I am creating mobile native application that uses REST API endpoints to communicate with server side. I have had previous experience developing native clients, but I have simple token (random ...
eemrxoha's user avatar
  • 131
12 votes
2 answers
13k views

Secure REST API and Single Page App by using external OAuth 2 Authorization Code

I am trying to understand how to implement an OAuth 2 Authorization Code flow when having both a single page JS app and a REST API. The aim is to secure access to the REST API by offloading ...
Anvar Karimson's user avatar
12 votes
4 answers
17k views

Why do APIs use API Keys instead of Usernames?

It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
Sinan Taifour's user avatar
11 votes
2 answers
7k views

Securing a REST api at the message level

I'd like some feedback on the following authentication idea, does it makes sense, and is there a standard way of doing this (or similar) so I can rely on a well tested implementation. I've seen many ...
Nicolas Esteves's user avatar
11 votes
1 answer
3k views

Social Login + OAuth2-secured REST API

I'm implementing social login with Facebook, Twitter and Google+ on our OAuth2-secured REST API (secured using spring-security-oauth). I'd like to make sure that the following flow is secure and that ...
Martin's user avatar
  • 211
10 votes
1 answer
19k views

PUT vs. POST for password update

I am writing a User Management system that has to include a change of password utility. We don't front end hash passwords (hopefully we will soon). As a result passwords are passed over https in the ...
ford prefect's user avatar
10 votes
1 answer
10k views

OAuth2 with client credentials v/s other auth mechanisms

For a REST API against which clients would be writing non-browser based, non-interactive applications, if OAuth2 is the authentication mechanism to be followed, then we would use the client ...
Shyamal Pandya's user avatar
9 votes
3 answers
2k views

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
Escualo's user avatar
  • 191
9 votes
3 answers
5k views

Are 500 responses or specific error codes more secure for REST services?

I am building a REST API to store security sensitive data for both my client and third-party partners. Each request is validated using an HMAC of certain data which is keyed on a temporary key ...
drz's user avatar
  • 193
9 votes
1 answer
9k views

HMAC solution for a rest API

I'm trying to learn some things about REST apis and one of the topics that I'm having some trouble is security. I'm using angularjs for web interface ans slim framework for the php api. I've read ...
Bruno Camarneiro's user avatar

1
2 3 4 5
8