Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

Filter by
Sorted by
Tagged with
0
votes
1answer
96 views

Authentication in RestAPI

I want to implement a security mechanism by which i can secure my RestApi from the "Clients who are not what they claim to be". In my case the consumer of API for now is another web service not ...
43
votes
10answers
20k views

Is it more secure to program a client-server system in a language other than English?

I'm developing a system with communication via REST between front (JavaScript) and back end (Java/Spring) and this question popped up. Does it makes this system more secure to name variables, URLs, ...
0
votes
1answer
2k views

How I can enumerate all endpoints of an API?

Let's say I have an API api.example.com and I want to test all endpoints. I don't have access to documentation, how I can enumerate all the endpoints?
3
votes
2answers
127 views

Is switching protocols a security measure worth implementing?

We deploy our internet facing applications in multiple vlans and there is a rule that talking from one vlan to the next has to be done in another protocol or an other implementation of the protocol. ...
27
votes
3answers
8k views

Generating one time URLs which can be revoked

I have a requirement to generate a one time use URL which should have the following features: As the URL query parameters may contain sensitive information, it should be encrypted (on top of https ...
2
votes
1answer
254 views

Security of Publicly exposed REST APIs

We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple ...
1
vote
0answers
361 views

tool with rest api to scan base64 encoded files [closed]

I'm searching for a tool (antimalware / antivirus) that exposes a REST API and accept me to pass a base64 encoded file in order to check if it's a malicious one or not. I've tried the ClaimAV but it ...
1
vote
4answers
1k views

How to prevent self-XSS?

I am creating a website which solely uses REST api for all the features and functionality, from signup and login to fetching data and populating the webpage using Mustache as template engine for ...
10
votes
2answers
16k views

Store Auth-Token in Cookie or Header?

I do understand that a header is the "cleaner" solution to transport an auth-token from a trusted system to another in a REST call. But when you are in client-side JavaScript code, the world looks ...
6
votes
2answers
6k views

Do I need to hash or encrypt API keys before storing them in a database?

I'm securing API calls to a REST service I'm building using API Keys. The plan is to: When we get a new client, generate an API Key (a UUID). Email the API key to them. They send the API key on every ...
1
vote
1answer
1k views

Store splitted JWT for CSRF protection and refresh strategy

I've been reading a lot about stateless authentication systems, and I want to implement something with JWT for the first time, but now I'm concerned about how to properly (and securely) consume a ...
0
votes
2answers
93 views

Secure way to send files to server, store, then retrieve

I am looking for ideas today. The problem: Sensitive files are sent via REST (over SSL, of course) to a third-party server. I cannot touch them programmatically until they arrive at the server. Those ...
3
votes
1answer
1k views

Secure RESTful api communication between multiple servers

Currently I have the following design: Central cloud hosted server with a REST api Multiple remote servers each with a REST api Data is posted from the remote servers to the central server at ...
1
vote
1answer
120 views

Best way to secure local REST server?

Currently I have a raspberry pi connected to my home security system. I have written a Python daemon running a HTTP server (very insecure I know, but this is still under construction) so I can send it ...
-1
votes
1answer
78 views

Is there any reason to use an encrypted value for the plain text signing key?

I am creating an API and I am thinking of using an encrypted value of some random password as the value to store for the plain text representation of my signing key. Is this just a vain attempt to ...
1
vote
2answers
957 views

Using burp-rest-api, how do I log into my web application in order to scan for vulnerabilities?

I am using the VMWare-developed Burp API (https://github.com/vmware/burp-rest-api) in order to try to automate web application scanning for my application. For an example, if I was attempting to test ...
3
votes
1answer
842 views

Why isn't Secure Remote Password protocol being used in REST APIs?

I have seen a few samples of SRP protocol used for web applications and I wonder why nobody ever uses it for RESTful authentication. I have done some research and I couldn't find any single example, ...
4
votes
1answer
4k views

Do I need additional encryption on top of HTTPS for a REST API?

Let's set up the environment before coming to my question. We have an web application which will be accessible by browsers/clients over HTTPS. Monstly only accessible in the intranet ( rarely over ...
21
votes
2answers
4k views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...
0
votes
1answer
487 views

Content-Type for a JWE Compact Serialization payload

The scenario is that the same code library is used by both client and server to encrypt/decrypt messages. The server application uses the library's encryption function to encrypt some content (that ...
2
votes
1answer
399 views

How to secure refresh token API's?

I have two API's used in auth: api/auth/newtoken: Successfully validates user (i.e. username and password check in DB) and return token (expirers in 3 days) and refreshToken. api/auth/updatetoken: ...
14
votes
10answers
8k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
1
vote
0answers
347 views

Securing a B2B (server to server) multi-tenant REST API [closed]

I am developing a B2B multi-tenant REST API which will be invoked by tenant’s (wallet provider) server application (secure or confidential client) on to perform some operations on its user’s accounts. ...
1
vote
1answer
169 views

Public guest user for PostgreSQL?

I manage an open-source software project that relies on data that I am happy to share with the public. The software is hosted on github.com, but the dataset is too large to host there. It is easiest ...
2
votes
1answer
2k views

How to secure handshake system-to-system in RESTful API calls without user/pass?

I have system X from another department in our company that sends basic user info (not passwords) to my system using RESTful API. Both systems are using subdomains of the same domain but reside on ...
1
vote
1answer
89 views

What's a proper way to secure REST interface from session stealing?

Let's suppose that attacker was able to inject JavaScript into website. Obviously he can do any HTTP request to backend mimicking user actions, unless there's some confirmation like SMS code which ...
0
votes
2answers
248 views

Is this passwordless authentification system is less secure than big websites authentifications?

I develop a web and mobile Application, managed by my REST API server (SSL with Strict-Transport-Security enabled). I don't believe anymore in the classic login/password authentification method (1)(2)(...
1
vote
1answer
221 views

How to prevent (cookieless) csrf attack?

This is a real world scenario. I'm trying to provide all the details necessary. Summary A user changes their IP with every request using a cookieless browser. How can I secure their login requests? ...
118
votes
5answers
52k views

Should I use CSRF protection on Rest API endpoints?

Quick note: this is not a duplicate of CSRF protection with custom headers (and without validating token) despite some overlap. That post discusses how to perform CSRF protection on Rest endpoints ...
1
vote
1answer
4k views

HTTP API request body encryption

I am building a Web API for a simple game. The API is SSL-only and uses limited-time tokens for user authentication. I would like to encrypt the contents of a specific request to prevent cheating. I ...
0
votes
1answer
2k views

Enforcing HTTPS Only With REST API

I'm developing a REST API that may take in private information. To make it secure, I want to have the API only accessible using HTTPS. Basically, what is the best way to enforce HTTPS only? Here are ...
1
vote
2answers
263 views

Preventing malicious usage from users with access tokens

So I have a web page running a JavaScript application, and a web service that the application makes HTTP PUT requests against. The service uses access tokens to verify the user’s identity, but now I’m ...
1
vote
1answer
784 views

Short living Json Web Tokens (understanding problem of JWT)

I considered using JWT for my REST-APi. The user should login at /api/login with basic auth and retrieves a JWT which is used for further requsts. At the beginning it was planned to have a very long ...
0
votes
1answer
157 views

API security where the server is also client-side

I have a desktop application which creates and stores a fair amount of data (mostly on its own, not through traditional user input); mostly statistical in nature. Currently the data is mostly ...
1
vote
3answers
193 views

Securing a rest API with one client

I am about to develop a REST API that will only have one "user" and I am curious about how I should implement security to make it as secure as possible(hopefully implementing some protocol that I am ...
0
votes
1answer
230 views

HTTP Verb tempering using MITM attack possibilities and prevention in rest api

HTTP Verb tempering using MITM attack possibilities and prevention in rest api. If an application URL is dependent only on http method to determine it's action, how can we reduce impact of tempering ...
2
votes
1answer
783 views

What's the state-of-the-art approach to secure a backend API?

Scope Currently we are developing a backend REST API which is consumed by handful of MVC applications. In this case we are talking only about server-server communication and the API won't be consumed ...
0
votes
2answers
746 views

Generating RSA keypair (safety/performance) in REST service

There is a REST API service. An endpoint is responsible for creation of user accounts. Each user is supposed to have an RSA keypair generated and stored on a server. To protect the private keys from ...
4
votes
2answers
509 views

Certificate Pinning vs E2E Encryption

I see that there are some APIs which exchange some sort public keys to secure the content of https connection using asymmetric encryption. Is there any added benefit to this? As far as I know, it ...
5
votes
2answers
2k views

How to Secure REST API from being crawled when serving public content ?

I have a ReactJs web app, an Android app that both consuming a REST API built with django, the whole project is for media/news, the biggest part of the REST API is public content, there is a little ...
1
vote
0answers
2k views

How website hide api response?

I build a web application and get data via REST API. eg: https://mywebapi.com/product/{productId} then I get json response and use the json data response in my web page https://myweb.com/product/{...
2
votes
1answer
971 views

How does the “post/redirect/get pattern” improve security?

How does the "post/redirect/get" (PRG) pattern improve security? I see the "confirmation through redundancy" principle at play, but I don't understand how they could counter-balance the risks. As a ...
5
votes
1answer
2k views

Content-type validation in REST APIs

I'm trying to wrap my head around, why it is advised to validate the content-type, sent by a client to a REST API. OWASP states in their REST Security Cheat Sheet: When POSTing or PUTting new data,...
30
votes
8answers
7k views

Is there a way to prevent someone from making his own client app for my webservice? [duplicate]

Say I have a RESTful web service and a commercial Android app on the front end which is used to interact with it. I may use SSL so that the endpoints are not visible, but someone could still do some ...
2
votes
3answers
5k views

URL injection vulnerability

I am busy with a pentest and found something that made me wonder if it would be exploitable. I am currently not able to exploit it, but I wanted to make sure. Also I am curious why the application/...
1
vote
2answers
71 views

What hashing/encrypting to use for publicly shared string matching a secret code

I am looking for the database-free way how to validate a secret code that was sent to user's mobile phone by RESTful web app, in a 2-factor authentication process. At step 1, the user provides login ...
1
vote
0answers
111 views

What HTTP headers do you generally suggest to use? [closed]

I feel like there's a lot of variation in the suggested HTTP headers. Commonly I see suggestions for: HTTP Strict Transport Security Content Security Policy X-Frame-Options (Same Origin) X-Xss-...
5
votes
2answers
354 views

Passing user identity to an internal REST service

I have two services - A and B - which both expose a HTTP/REST API. Service A is exposed to the public and authenticates its users. It delegates part of the workload to service B which also has to know ...
10
votes
1answer
3k views

REST API authentication with JWT and CSRF protection for SPA

I'm developing an SPA with REST back end and want to have simple token based authentication. The goal for REST backed is to be stateless. I will explain the security model and try to reference all ...
11
votes
1answer
3k views

What kind of hashing to use for storing REST API tokens in the database?

We have a REST API that communicates with a mobile front-end. After submitting a one time password, the backend will issue a token (random UUID v4 string) for the mobile app to use as authentication ...