Questions tagged [rest]
An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.
378
questions
11
votes
2
answers
6k
views
Securing a REST api at the message level
I'd like some feedback on the following authentication idea, does it makes sense, and is there a standard
way of doing this (or similar) so I can rely on a well tested implementation.
I've seen many ...
- 111
5
votes
0
answers
176
views
Stateless REST API and secure server side password storage [duplicate]
RE: Duplicate - Did anyone actually read my question? The question marked as duplicate is in no way, shape, or form what I'm asking. I specifically state that a DB compromise must not allow an ...
- 181
-3
votes
1
answer
1k
views
Security of web services (REST & SOAP) [closed]
I'm doing a state of the art on web services security. I need every bit of a solution out there that solves concerns about identification, access control, transmission related ones like data integrity,...
- 109
5
votes
1
answer
220
views
Resources/materials for implementing secure web services?
I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
- 529
23
votes
1
answer
11k
views
Why a symmetric key for HMAC?
I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard ...
- 233
1
vote
1
answer
718
views
Basic Authentication with WebAPI and HTML/JS Client?
I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and ...
- 11
16
votes
2
answers
8k
views
Client authentication vs. user authentication
I am currently looking into authentication protocols which work well with REST API, in java.
There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
- 163
5
votes
1
answer
1k
views
user/pass auth vs hmac signed for REST API
I know they both prevent the RESTful APIs from abuse. Hmac signed api is commonly used than the other. But I think using user/pass pair for authorization is more security, here's the reason:
To sign ...
- 53
2
votes
1
answer
297
views
Best practices for setting up client connections to a server with app credentials
The question title is... ugly to say the least. Here's an overview of what I've got:
I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back.
...
- 161
11
votes
4
answers
16k
views
Why do APIs use API Keys instead of Usernames?
It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
- 213
15
votes
2
answers
4k
views
Is request signing (digesting the request body) in a REST API necessary?
I am currently engaged in a debate and I wondered what the community's opinion on this was.
We see REST APIs which just require basic authentication (perhaps HTTP) or OAuth.
We see REST APIs which ...
- 251
3
votes
3
answers
5k
views
Looking for feedback on my REST-style API authentication design and two-factor authentication
Authentication
The authentication is going to be signature-based. The signature will be generated using:
HMAC_SHA256(SHA1(secret_key) + '#' + request_data + '#' + utc_timestamp)
The utc_timestamp ...
- 131
5
votes
3
answers
7k
views
HMAC What is secure manner to distribute shared secret between client and server?
I am looking at ways to secure http communication using HMAC. My understanding is that in this scenario the client and the server both know a secret. This means the secret must be first generated on ...
- 51
0
votes
2
answers
226
views
Why do services like Twitter have tokens and secrets for 3rd party apps?
I noticed that if you have a 3rd-party Twitter app, you get an access token, and an access token secret, to communicate with Twitter.
Why are there two codes? Shouldn't one be enough?
Does this mean ...
- 103
4
votes
2
answers
2k
views
Securing anonymous accessible URL with a GUID segment?
In my problem there is an existing system that works as a alerting or clipping service that runs user defined searches and generates results lists. These are setup by authenticated users and this ...
- 501
8
votes
2
answers
1k
views
An adequate message authentication code for REST
My REST service currently uses SCRAM authentication to issue tokens for callers and users.
Tokens issued by the SCRAM exchange have an expiry time after which a repeated sign-in is required. We also ...
- 183
89
votes
7
answers
98k
views
How do I secure my REST API?
In detail here's the problem:
I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After searching with Google for a ...
- 993
72
votes
3
answers
52k
views
Securing a JavaScript Single Page App with RESTful backend
I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
- 831
4
votes
1
answer
434
views
Custom EC2-style user authentication system - how secure is it?
At work I'm trying to design a user authentication system that is session-less (including session based tokens such as those used in OAuth2) due to client software requirements. The services are REST ...
- 41
16
votes
6
answers
21k
views
Securing an API for mobile access
I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
- 303
1
vote
1
answer
805
views
Web Service Security
We are currently designing a Web Service that returns a JSON formatted messages. The following are the planned implementation for the service's security:
An SSL Certification to the service for the ...
6
votes
2
answers
3k
views
Security drawbacks for using short-lived access token in javascript client side
I intend to build a front end site entirely in javascript (NodeJS) and i would like to do ajax calls to a REST WS which is on another domain on client side.
I intend to use oauth2 and SSL to secure ...
- 361
2
votes
1
answer
723
views
Multiple security layers for SOA REST intranet services
For intranet applications that already leverage Active Directory, is there any point or benefit to adding a second layer of security such as OAuth when accessing SOA REST services? We're new to SOA ...
- 185
65
votes
6
answers
99k
views
SSL with GET and POST
I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests?
For instance, if I have two requests
GET:
www.mycoolsite.com/index?id=1&type=...
- 753
1
vote
1
answer
2k
views
How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?
I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
Zachary Carter
18
votes
1
answer
6k
views
Best way to secure javascript front end/REST back end architecture web site?
I would like to build the following project:
public REST API back end which can be accessed by any authenticated client.
front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
- 361
9
votes
3
answers
2k
views
Any flaws in this security model for a REST web service?
I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
- 191
16
votes
1
answer
4k
views
REST specific security weaknesses
I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST.
What I would ...
- 1,277