Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

Filter by
Sorted by
Tagged with
2
votes
1answer
3k views

CSRF and JSON APIs

I was searching for an CSRF implementation for Express.js, and i found something that get my atention, in this post it says that a JSON API is nos vulnerable to CRSF attacks... is that correct?? is ...
36
votes
11answers
10k views

Returning the wrong HTTP response code on purpose?

I'm writing a simple REST API, and I want to restrict access to my mobile-client only. In other words, I'm trying to prevent a malicious user from e.g. using curl to make an unauthorized POST request. ...
1
vote
0answers
35 views

securing a REST end point for 3rd part applications to connect to

Im generating a REST database service for an android application to connect to, and have little to no security experience. the service currently uses OAuth2 to secure a web front end with a Spring ...
0
votes
1answer
862 views

Nginx Form-base Authentication

I want to have nginx in front of my Tomcat and to act as a authentication gateway. So if request is not authenticated in will be redirected to login form that will also be stored on nginx. nginx will ...
2
votes
3answers
1k views

ASP.Net Web API make HTTPS Mandatory

Is there any programmatic way that where I can mandate the HTTPS in my ASP.Net Web API? I need to perform this for all HTTP methods in my Web API. Can we mandate HTTPS to specific HTTP messages as ...
1
vote
2answers
570 views

Allow DELETE method over firewall WEB API 2

I am working with a ASP.Net Web API 2 service and the firewall denies the DELETE method to go through (only POST and GET are allowed). Is there a way that we can bypass this and invoke my DELETE ...
0
votes
0answers
119 views

Arduino/ATMega calling HTTPS REST services

Background I am working on an IoT project where we are using ATMega Micro Controllers as end devices. These devices need to communicate with REST services and post some sensitive data. The REST ...
2
votes
1answer
3k views

Securely store password for Java Keystore

Background I am implementing set of Micro services using Java spring MVC and hosted in Undertow containers using Gradle. I am using a Java keystore to secure my keys which are using by the service to ...
0
votes
1answer
1k views

Passing an encrypted value in Java Spring REST API query string

I am using set of REST APIs build using Java Spring. I need to pass an encrypted value from client to a REST service. The client invokes a GET request. My question is how secure and efficient it is ...
1
vote
2answers
413 views

Tool to listen http traffic goes to different ports (Windows) [closed]

I am using a set of microservices (Spring MVC Hosted in Undertow containers along with Gradle) which are spawned on different ports in the same machine. Services make HTTP REST to each other. I need ...
3
votes
1answer
2k views

Does Wordpress REST API with CORS enabled represent a security risk?

After a security inspection of a site running Wordpress with a REST API, the scanner flagged the route /wp-json/ as a vulnerability due to a very flexible CORS policy that allows third parties to ...
5
votes
5answers
6k views

Hiding sensitive data in URIs

This is a potentially hypothetical question since it has not been determined whether we will be required to do this but I figure it's a question that will come up more often. Background When ...
1
vote
1answer
281 views

Securing a Web API in MVC

I've got a simple ASP MVC 6 WebAPI I'm currently working on in which registered users can call request data using a sample of the URL below: http://localhost:7988/api/b8pE5Qodiw/elections/Prop1/Prop2/...
1
vote
2answers
57 views

How to properly handle unathorized errors in SPAs [closed]

In order to prevent URL guessing for unauthorized users I will return a 404 error even if the URL exists. It's better to always return a 404 error page even if the call is to an API?? or is better to ...
1
vote
0answers
80 views

How to safely generate and store a password out of Google OAuth user data (for another REST API)

I have a web app, where users sign in with Google (OAuth 2.0). This web app uses a REST API (figo.io) in the background, so I have to create an API user with credentials. Now I have the following ...
0
votes
1answer
795 views

Securing Authentication Tokens Stored in the Server-Side Database

I'm working on extending a web application with a RESTful HTTP-based API. We decided to require the client to supply an authentication token in each request (instead of using sessions or other multi-...
6
votes
2answers
9k views

Java UUID.randomUUID() or SecureRandom for id segment on URL?

In building a Java based system that needs unique identifiers on the URL, is UUID.randomUUID() or SecureRandom a better choice? More specifically, a call to POST /items will return a 201 Created with ...
4
votes
1answer
2k views

How does sign-in with Social Login work for a 3rd party relying party

I am trying to understand how to add social login and registration to a service. After reading many blogs posts, many reminding me of the pitfalls of designing such a system, of the fact that Oauth ...
2
votes
2answers
983 views

Should I expose HTTP status code 500 on a REST application?

In my Spring MVC 3 application, I am following REST patterns and lots of logic is based on HTTP status codes. For instance 500 defines a server error. But OWASP modsecurity says not to expose this ...
1
vote
1answer
846 views

Post Data tamper detection [closed]

I have been studying a bit on security on how to make my mobile rest server secure. I am looking at one mobile application that uses plain HTTP. I have Charles proxy breakpoint enabled and edit the ...
3
votes
2answers
4k views

CORS REST API whitelist

I have a REST API. I want to use this API from multiple web applications. I want to only allow requests from Whitelisted clients. My first point of call would be to add the necessary headers to the ...
0
votes
2answers
116 views

Resend encrypted REST GET request to eavesdrop data

Bob makes a HTTPS GET request to view his personal info on a dating site via a RESTFul web service. He supplies his api key,secret,timestamp and signature to prove that the request came from him. All ...
0
votes
1answer
108 views

Can I use this webservice safely?

I'm trying to integrate with my host using their REST webservices. However, the authentication for the webservice only requires two things: An API token which I can retreive from their portal once ...
5
votes
2answers
4k views

Preventing resubmission and replay attack using client nonce in REST API

I have a REST API backend which has HTTPS (and blocked HTTP) and use JWT as the authentication mechanism. Client side is iOS/Android App. I want to add a layer of safeguard on critical API by using ...
2
votes
1answer
7k views

iframe basic auth or token security

We have two sites, both are trusted. On site1 we store the username and password for the user for site2. We make api calls on site1's backend to site2 via basic auth (all over HTTPS). Despite the ...
2
votes
1answer
453 views

How to securely access web api from Html5 Website

So the thing is I have created a Asp.Net web api and am using oauth to secure the access. The problem is that the clients want to make a pure html(angular) website from which they will access the api. ...
8
votes
1answer
2k views

Why isn't Amazon using a NONCE for REST Authentication?

When you look at Amazons RESTAuthentication you can see that it doesn't use a nonce: Authorization = "AWS" + " " + AWSAccessKeyId + ":" + Signature; Signature = Base64( HMAC-SHA1( ...
6
votes
1answer
899 views

Simple Authentication Method to Secure REST API

I've been desperately trying to find a simple method of securing my API but still haven't found one that works. Unlike a lot RESTful APIs my API doesn't need user logins, tokens that expire, or other ...
3
votes
3answers
8k views

Is hashing passwords with bcrypt and a constant salt more unsecure than SHA1?

I've built an API that allows users to submit encrypted data to be stored in the cloud. To retrieve their data, the API requires the user to supply only the MongoDB Object ID that they are given when ...
1
vote
2answers
46 views

Should a Web site be allowed to use a third party web service directly?

Imagine I have a web site running on an IIS. The web site needs to get/send sensitive data from a 3rd party REST web service. Is there any reason why a web site (server side, not client side) should ...
5
votes
1answer
1k views

REST API security mobile application with PIN

I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved). As part of the login flow we have been instructed to ...
20
votes
1answer
26k views

How do you pen test a REST API?

We have a server that is running a REST API on port 443. I'd like to make sure it's secure by doing various pen tests on it. I'm used to doing offensive testing on a webpage where I can see code, and ...
1
vote
1answer
814 views

How to secure android REST basic authentication credentials against reverse engineering?

As far as I know, in basic REST API authentication, username and password to access web service resources are baked into the app's code. On the other hand, it seems not difficult to reverse engineer ...
2
votes
1answer
314 views

Would this RESTful login system be secure?

So I have been thinking about a way to make a secure restful API for application logins. This is what my teacher and I have come up with: The Client (swift program) initializes the connection with ...
2
votes
1answer
852 views

Vulnerabilities of using a token based authentication such as this

I'm developing a backend REST API for one of my mobile apps. I'm looking to create a token-based authentication system that would allow for a persistent login and I'm wondering if there are any ...
1
vote
0answers
41 views

Securing promotional discounts

I have a service, offering a physical good in exchange for either money or via code given out by us. The service is accessed through a mobile application. The codes have usage restrictions, for ...
3
votes
1answer
380 views

Single Page Application with REST API backend based on XML, queried by dynamic XPath

A web application I'm developing will be a Single Page Application (SPA) that will interact with a REST API backend, through jQuery.ajax() calls. The SPA and API will both be served over an https/TLS ...
5
votes
1answer
2k views

Sending non-expiring access token on each request vs using refresh tokens?

When securing REST APIs for mobile applications, what you often see is the use of refresh tokens. They exist because: Access Tokens have expiration date. We don't want the user to have to enter his ...
2
votes
0answers
47 views

Securing an error-reporting API against spamming

We are planning/spec'ing a REST API for communication with an iOS app an external team is building. For most calls, the API key hardcoded into the application and a session ID produced on our side ...
4
votes
1answer
121 views

Best practices for relatively simple API for our clients

I've been reading a lot about many API security considerations, the differences in terminology, OAUTH, OpenID, etc. Although I understand their absolute necessity when it comes to securing an API ...
4
votes
1answer
92 views

REST and confidential state - the trusted client problem etc?

With REST client sessions are not handled by maintaining server side state. Any such state needed for subsequent calls is passed to the client and then passed back to the server as part of those calls....
3
votes
2answers
435 views

Securing ASP.net web api (REST) [closed]

I am developing a middle-ware web service app (REST) using ASP.net MVC-4 web API. The rest services are consumed by android, ios, angularjs client apps. The same user is able to use multiple ...
0
votes
2answers
182 views

Using mutual authentication, should I still worry about message integrity and replay attack?

I'm trying to secure a REST API, our situation is that every client connecting to this API will also have a certificate signed by our own CA. Because of this, I think we can use the client certificate ...
1
vote
1answer
343 views

SSL MITM attack vectors for server to server HTTPS using an untrusted certificate?

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default. What are obvious attack vectors for MITMing a server-to-server HTTPS communication ...
0
votes
1answer
120 views

Attack vectors for server to server using untrusted HTTPS certificates? [closed]

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default. For example, from the documentation for node's request: strictSSL - If true, ...
3
votes
3answers
1k views

Risks of securing REST API using SSL?

We are thinking of building a REST API where all calls are over SSL. After successful login subsequent calls will include a token which was returned by the login service. The server will validate ...
17
votes
2answers
13k views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
1
vote
0answers
84 views

How to authorize users for rest service

me and my friend are doing a project for a company. It involves getting some information from the database and display it on a smartglass device (epson, sony, ...). Now we want to build a RESTful ...
2
votes
0answers
1k views

Avoiding Client impersonation with Rest Api

I'm sure that this use case has a known solution, but I can't find anything on google or I don't know which keywords to use. We are building an Angular app that is backed by a Rest Api. For ...
0
votes
1answer
249 views

How to prevent unintended REST API usage?

For a university project, I am supposed to implement an API that allows storage and retrival of strings. Clients accessing this api can be mobile phone apps and low power embedded devices. The data ...