Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

Filter by
Sorted by
Tagged with
0
votes
2answers
223 views

Angular (2+) code visibility to users

I'm looking into Angular and read that typescript is compiled to javascript. Is everything viewable/visible to users that I write using typescript? With PHP I know you run code that's only visible to ...
0
votes
2answers
163 views

Is it safe to publish a REST API client on npm even though the API is not intended for public use?

I am build a website in Angular which communicates over my REST API on my backend server. I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on ...
1
vote
1answer
143 views

Security Risk of outbound web calls [closed]

What possible risks/attack vectors could be introduced be allowing my server application to make outbound calls to a 3rd party REST API? The 3rd party REST API is off premises and owned and operated ...
1
vote
0answers
104 views

Is it possible to get hacked by a redirection placed inside a Facebook Graph URL?

Basically, I have a webapp which needs to check the validity of the user of an Android app. After completing the basic login flow with Facebook in the Android app, a Facebook access token is sent to ...
1
vote
1answer
2k views

How to invalidate JWT tokens without a database lookup with each request to the server?

JWT Bearer token and stateless REST API question I am implementing a stateless REST API. I am used to using sessions built into frameworks or 0Auth but now I am in the process of developing my own ...
2
votes
0answers
187 views

Is it safe to let users enter a URL in my app that queries an external REST api?

The idea was to allow users to enter a URL inside the application that would send a request to my backend, fetch the data, and load it into a local cache (Apollo/GraphQL). The only sensitive data sent ...
0
votes
1answer
121 views

Token Based Authentication

I have a React app that connects to a REST API for which I have to implement token based authentication. The only info stored in the token is the user id. The following flow will be used: User logs ...
0
votes
1answer
184 views

Golang REST API: Security checks? [duplicate]

It's my first time building and deploying a REST API with just the standard library. Are there any gotchas I should keep an eye out for regarding securing my REST API?
1
vote
0answers
101 views

Calling Powershell script from external program passing an argument

I have an external program which calls a PowerShell script with a random secret identifier as a single argument. The PowerShell script needs to return the same random secret id when it calls the REST ...
0
votes
0answers
91 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...
2
votes
1answer
953 views

Securing API access. oAuth Client Credentials vs client ID and secret

I have a REST API that will be called by other external 3rd party servers over the internet and be used only for machine to machine communication. I am looking for mechanisms to secure this API such ...
4
votes
2answers
230 views

Is this security scheme using passwords, short-lived access JWTs, and long-lived refresh tokens a good way to secure a REST API?

I'm trying to secure a REST API that I'm using as a backend for a single-page application. The API provides access to read/create/modify/delete protected resources, based on a set of permissions ...
2
votes
3answers
171 views

Windows Account Password Resetting process for large network

I am working on large windows based network environment (Active Directory) and I have a requirement of implementing clear and secure password reset process for windows user. Especially management ...
1
vote
1answer
440 views

How to protect against injection into a 3rd party REST API?

I have a 3rd party API that I need to connect to and they allow queries that can be formed by changing url parameters. E.g. /data?startDate=2019-01-01 or /data?name='John Doe' It is easy to form ...
1
vote
1answer
93 views

Is using an access token for authentication a bad idea

Is it right that if there is a malicious browser extension allowed to "Read and change all your data on the websites you visit." on the users's machine an access token can be potentially leaked no ...
0
votes
2answers
255 views

JWT vs custom encryption for REST APIs over https

For our REST API architecture, we are currently thinking over two options - Json Web Token - pros are that it is industry standard, we pass a key which adds a layer of access control and using which ...
0
votes
0answers
78 views

How to protect API that should be accessible to everyone? [duplicate]

I have some API that should be accessible from a very long list of devices (some of them can reach my Oauth2 server and get some token, some of them cannot). These devices are mobile phones (IOS, ...
1
vote
0answers
165 views

Security aspect in the API gateway area

I am currently planning security testing procedures within an API gateway. We want to define in advance what we expect to be covered on the security level. Scanning REST APIs (see http://docs.w3af....
2
votes
2answers
339 views

Does TLS have any way of exposing only the URI in a SSL-SSL proxy, or BlueCoat style appliance?

I'm writing an experimental authentication protocol and need to see the unencrypted URI's of the HTTP Call, but want to provably show that I can't see the data. Does any standard, or feature exist ...
1
vote
1answer
266 views

Secure REST API that only works for users authenticated by App with SSO (OAuth?)

I somehow need to accomplish the following: User accesses a application written in JavaScript. Application uses SSO to identify the user who is logged into Windows. Application obtains the access ...
0
votes
2answers
5k views

Rest API Sensitive Data GET

We are trying to decide the best approach to designing our new interface with our consumers. Currently we are talking about an Rest API. However there is some debate among our team about how to ...
1
vote
1answer
246 views

Security and the Definition of Ready and Done [closed]

Currently I am in a project where I have to test REST APIs among other things. In another question of mine I also discussed the topics Definition of Ready and Definition of Done regarding security. ...
0
votes
2answers
182 views

Rest API Security Guideline. Developer Rules? [closed]

In my current project I am also setting up the area of security testing. So far there was no way to use security within the REST API development. Beside the known approach, e.g. using static software ...
5
votes
4answers
165 views

Security considerations of consuming public API

I have a website and i want to consume public API from third party services such as Zoopla, weather etc. I want to ensure i do not consume malicious code/malware from the data retrieved from the 3rd ...
1
vote
0answers
141 views

Cross site security for public REST API

This seems a common use case, but I have not been able to find a satisfactory answer. We have a public REST API, which we want 3rd parties to be able to write their own Progressive Web Applications ...
1
vote
0answers
82 views

Public report/telemetry API

I want to implement a telemetry data sender into my electron app. The API which I want to connect to is public. So any crash reports or any other data from the user is sent to it. The problem is how ...
1
vote
1answer
144 views

Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?

I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
1
vote
0answers
88 views

Security risks on returning encrypted JSON web token without prior authentication

I am architecting a passwordless REST API where public/private keys are the primary form of authentication. In order to create a new session you must prove that you hold the private key to the public ...
2
votes
1answer
1k views

Exploitability of allowed wildcard (*) CORS Origins with Bearer Token Authorization [duplicate]

I'm looking at the following setup. A web application uses a REST API to communicate with the server. All API responses include Origin: *. For authorization Authorization: Bearer <token> is used....
0
votes
1answer
111 views

Preventing an unauthorized mobile application from calling REST back end services [duplicate]

In my scenario, I have an Android mobile application which calls my back end REST services. I want prevent other application to call my back end REST services. If I use certificate and shared key as ...
1
vote
1answer
572 views

Should I report this Google API key disclosure issue or not?

I have been asked to perform a pentest on a website from a company. I was analyzing the javascript files they were using, and I found a link pointing to: https://www.googleapis.com/customsearch/v1/...
1
vote
2answers
114 views

No put/delete in API, parametrized query, sanitized user input - enough for API security

If my Restful Flask API doesn't need user login, then are the following features enough for the API security: There is only a get method in my API, no put/delete methods. Queries are parametrized ...
2
votes
1answer
1k views

Why is PKCE secure against man-in-the-middle attacks?

In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
0
votes
0answers
90 views

Secure Personal Information for Restful API

I need to implement a web application for user to update personal information. It consists of a page listing masked personal information and then a button which allows user to edit & update them. ...
0
votes
1answer
71 views

Secure Exchange Rate for Restful API

I need to implement a web application for user to exchange money. The application needs to invoke API #1 to retrieve exchange rate and show it on the screen for confirmation. And then invoke another ...
-1
votes
1answer
99 views

How do I detect spoofed REST API responses in my webapp?

I am building an internal admin panel for my team that will communicate to the backend server using a REST API. One of the API calls that will be performed will be an "authorization check" where the ...
0
votes
0answers
56 views

Restrict RESTful Routes to Authorized Clients

I am building an application that stores form entries. It will accept post requests from a client web application and store the information as defined in the request. For example, frontend.com makes a ...
2
votes
1answer
456 views

Unauthorized API Access Without Key Header

In order to test the security of my API, I want to act as sort of an attacker in order to try and gain access to my own API without an API key. In order for me to send requests to this endpoint, I ...
2
votes
2answers
1k views

Is IP whitelisting safe enough for a HTTP Basic protected service available on the internet?

We are discussing about making available through the internet one of our microservices deployed on a public cloud on Kubernetes. This ms offers some sensitive information to the clients. This ...
1
vote
0answers
187 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
20
votes
5answers
13k views

Why should someone block all methods other than GET and POST in a RESTful application?

TL;DR: Is there a valid reason to demand a software vendor to stop using HTTP PUT and DELETE methods in a web application and use only GET and POST? The application uses frameworks to whitelist ...
1
vote
0answers
395 views

Securing RESTful APIs with Private Keys

I'm currently working on building a rest service that other applications which we create will utilize (from backend application servers). My current process uses a single private key value for ...
0
votes
1answer
1k views

What all test cases/vulnerabilities we need to try in REST API Pen testing?

I am learning API pen testing and looking for resources which will give clear list of test cases we need to check while performing a Pen testing on REST API. I have gone through the OWASP resources ...
0
votes
2answers
124 views

How can I secure a REST service intended to be used by my customers' customers via their public website?

I am developing a service with an associated REST API for customers (companies which have their own websites) to use. In other words, one of my customers would typically make the REST call directly ...
2
votes
2answers
260 views

Sensitive data enumeration via HTTP error codes

Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user Bob a message to his cell phone which he registered on our ...
1
vote
0answers
130 views

Bloom filter to prevent replay attacks in signed HTTP requests

I'm thinking about an authentication sheme of a REST API in a setting where the only thing the server stores about a client, is their public key (the asymmetric encryption scheme should not matter). ...
4
votes
2answers
393 views

Deal with API Webhooks that refuses authenticating itself

I'm currently in the process of writing a connector to an API. It's for an automated shipping system and I'm required to listen to events from that given API, sent via Webhooks. The API owner does ...
0
votes
0answers
389 views

Exposing protected API without hardcoding credentials in the Client (JS)

Try to expose protected REST API without exposing credentials in the Client (JS Code). All solutions that come to my mind, can be reversed and the Attacker can reconstruct them. Are there any ...
3
votes
4answers
1k views

Are there any reasons to add a payload signature to a REST API with mutual TLS?

We have a B2B REST API with Client Certificate authentication. Are there any reasons to add also a payload signature check to this API? I'm seeing many service providers which add a digital signature ...
1
vote
2answers
2k views

CSRF Origin and Referer Header just check host?

Note: This question is not the same as the linked possible duplicate. That question asks how checking the origin/referer header protects against CSRF. This questions is asking how to implement the ...

1
2
3 4 5
8