Questions tagged [rest]

An abreviation for REpresentational State Transfer. A design pattern for stateless client-server systems. Popular in the implementation of web services.

Filter by
Sorted by
Tagged with
11 votes
2 answers

Securing a REST api at the message level

I'd like some feedback on the following authentication idea, does it makes sense, and is there a standard way of doing this (or similar) so I can rely on a well tested implementation. I've seen many ...
Nicolas Esteves's user avatar
5 votes
0 answers

Stateless REST API and secure server side password storage [duplicate]

RE: Duplicate - Did anyone actually read my question? The question marked as duplicate is in no way, shape, or form what I'm asking. I specifically state that a DB compromise must not allow an ...
regretoverflow's user avatar
-3 votes
1 answer

Security of web services (REST & SOAP) [closed]

I'm doing a state of the art on web services security. I need every bit of a solution out there that solves concerns about identification, access control, transmission related ones like data integrity,...
Oussama L.'s user avatar
5 votes
1 answer

Resources/materials for implementing secure web services?

I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality ...
glitch's user avatar
  • 529
23 votes
1 answer

Why a symmetric key for HMAC?

I am working on securing a RESTful API and am using the Amazon AWS HMAC model as my guide. I am struggling with coming up with a secure way to store the symmetric keys on my end. What is the standard ...
user25231's user avatar
  • 233
1 vote
1 answer

Basic Authentication with WebAPI and HTML/JS Client?

I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and ...
Guest2050's user avatar
16 votes
2 answers

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
rita potter's user avatar
5 votes
1 answer

user/pass auth vs hmac signed for REST API

I know they both prevent the RESTful APIs from abuse. Hmac signed api is commonly used than the other. But I think using user/pass pair for authorization is more security, here's the reason: To sign ...
user23832's user avatar
2 votes
1 answer

Best practices for setting up client connections to a server with app credentials

The question title is... ugly to say the least. Here's an overview of what I've got: I work on an online tool. Data is sent to it, it processes the data (an intensive task) and sends results back. ...
Dave's user avatar
  • 161
11 votes
4 answers

Why do APIs use API Keys instead of Usernames?

It is now common to use an API Key to identify an agent when dealing with an API. What are the merits of doing that over using a username specified by the developer? Is it simply that the API Key is ...
Sinan Taifour's user avatar
15 votes
2 answers

Is request signing (digesting the request body) in a REST API necessary?

I am currently engaged in a debate and I wondered what the community's opinion on this was. We see REST APIs which just require basic authentication (perhaps HTTP) or OAuth. We see REST APIs which ...
Jamie Edwards's user avatar
3 votes
3 answers

Looking for feedback on my REST-style API authentication design and two-factor authentication

Authentication The authentication is going to be signature-based. The signature will be generated using: HMAC_SHA256(SHA1(secret_key) + '#' + request_data + '#' + utc_timestamp) The utc_timestamp ...
Andriy Lesyuk's user avatar
5 votes
3 answers

HMAC What is secure manner to distribute shared secret between client and server?

I am looking at ways to secure http communication using HMAC. My understanding is that in this scenario the client and the server both know a secret. This means the secret must be first generated on ...
Place Places's user avatar
0 votes
2 answers

Why do services like Twitter have tokens and secrets for 3rd party apps?

I noticed that if you have a 3rd-party Twitter app, you get an access token, and an access token secret, to communicate with Twitter. Why are there two codes? Shouldn't one be enough? Does this mean ...
Darkwater's user avatar
  • 103
4 votes
2 answers

Securing anonymous accessible URL with a GUID segment?

In my problem there is an existing system that works as a alerting or clipping service that runs user defined searches and generates results lists. These are setup by authenticated users and this ...
Kevin Hakanson's user avatar
8 votes
2 answers

An adequate message authentication code for REST

My REST service currently uses SCRAM authentication to issue tokens for callers and users. Tokens issued by the SCRAM exchange have an expiry time after which a repeated sign-in is required. We also ...
Andras Zoltan's user avatar
89 votes
7 answers

How do I secure my REST API?

In detail here's the problem: I'm building an Android app, which consumes my REST API on the back-end. I need to build a Registration and Login API to begin with. After searching with Google for a ...
noob Mama's user avatar
  • 993
72 votes
3 answers

Securing a JavaScript Single Page App with RESTful backend

I'm currently in the process of building a JavaScript SPA and have been researching how to secure it. There is currently as RESTful API that is being completely interacted with through AJAX. We also ...
Jon Wingfield's user avatar
4 votes
1 answer

Custom EC2-style user authentication system - how secure is it?

At work I'm trying to design a user authentication system that is session-less (including session based tokens such as those used in OAuth2) due to client software requirements. The services are REST ...
Dave Clayton's user avatar
16 votes
6 answers

Securing an API for mobile access

I've built a nice REST/JSON API that is used by other companies (our clients) as a B2B service. Each of our clients has a username/password pair, and we also do HTTPS and validate the source IP of ...
Tal Weiss's user avatar
  • 303
1 vote
1 answer

Web Service Security

We are currently designing a Web Service that returns a JSON formatted messages. The following are the planned implementation for the service's security: An SSL Certification to the service for the ...
John Isaiah Carmona's user avatar
6 votes
2 answers

Security drawbacks for using short-lived access token in javascript client side

I intend to build a front end site entirely in javascript (NodeJS) and i would like to do ajax calls to a REST WS which is on another domain on client side. I intend to use oauth2 and SSL to secure ...
rico's user avatar
  • 361
2 votes
1 answer

Multiple security layers for SOA REST intranet services

For intranet applications that already leverage Active Directory, is there any point or benefit to adding a second layer of security such as OAuth when accessing SOA REST services? We're new to SOA ...
KodeKreachor's user avatar
65 votes
6 answers

SSL with GET and POST

I'm pretty new to security, so forgive my basic question, but does SSL encrypt POST requests but not GET requests? For instance, if I have two requests GET:
TomJ's user avatar
  • 753
1 vote
1 answer

How to best authenticate a desktop client with a scaleable backend via SOAP / REST service?

I'm trying to find a solid architecture for authenticating users against a database. I have a game client, which I plan to serve up a request with. The transport doesn't really matter, but at this ...
user avatar
18 votes
1 answer

Best way to secure javascript front end/REST back end architecture web site?

I would like to build the following project: public REST API back end which can be accessed by any authenticated client. front end with static files in HTML/CSS/Javascript with Backbone.js jQuery ...
rico's user avatar
  • 361
9 votes
3 answers

Any flaws in this security model for a REST web service?

I have designed a REST web service which requires authentication. It handles authentication in a manner similar to Amazon Web Services, namely: the user has an ACCESS_KEY (say, 'abcd') and a ...
Escualo's user avatar
  • 191
16 votes
1 answer

REST specific security weaknesses

I need to start working with RESTfull Web Services. SOAP based web services have already so many standards to secure communication, establish trust etc. I am not aware of any for REST. What I would ...
Stefany's user avatar
  • 1,277

4 5 6 7