Questions tagged [web-service]

A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't intended to be directly shown in browser.

Filter by
Sorted by
Tagged with
0 votes
0 answers
27 views

What metadata could be stored in the IPFS network and what could be collected by modified nodes?

I'm guessing uploading to IPFS also uploads some metadata, which gets shared as well, does this assumption hold any truth? According to this only content identifiers and node identifiers are in the ...
user avatar
0 votes
2 answers
42 views

Digital signature for API authentication feasible?

Could it be practical to authenticate API request through digital signature (based on headers and message body)? This would be asymmetric instead of something like HMAC which is not a signature. ...
user avatar
  • 101
0 votes
0 answers
31 views

Penetration Testing of a Web Page instead of whole site

I am interested in testing a website's new feature which is available on a single a web page (addition in original website) and have some editable fields. Other than checking input validation on those ...
user avatar
  • 201
0 votes
1 answer
23 views

Does a hash-based storage cache design require additional access-control?

Please forgive the vagueness of the question title. I am currently working/designing an opaque storage of immutable files. The purpose of the service is simple: storing files and being able to ...
user avatar
  • 134
0 votes
0 answers
87 views

Is using a developer key to protect a REST API good practice?

I'd like to implement a RESTful API service over HTTP that developers can call from their server side environments. I intend to use a cryptographically secure pseudo-random number generator (CSPRNG) ...
user avatar
-2 votes
1 answer
107 views

Online service to download file from URL directly as zip [closed]

Is there an online service which allows to download a file from a URL directly zipped? I want to analyze a potential malicious JavaScript file with some automatic anti virus engines but I don't want ...
user avatar
  • 125
0 votes
0 answers
98 views

Hybrid-Analysis.com indicates the website that my macOS system is contacting is likely malicious

Backstory: I just upgraded my MacBook from OS X 10.11.6 to the most updated version of macOS, 10.14.6 Mojave. I also have the Little Snitch network filter installed. I know nearly nothing about ...
user avatar
0 votes
0 answers
90 views

What's the best practices for storing 2fa tokens? [duplicate]

What are the best practices for securely storing TOTP secrets as an extra layer of security for user accounts? This would be used in a webapp login and stored in a server database so that the user can ...
user avatar
0 votes
1 answer
86 views

Protect server-side key with client token

I'd like to encrypt some data on the server using a user-managed secret. I could just ask for a password and derive a key from that, but ideally I'd like to offer users the option of using a yubikey ...
user avatar
  • 123
17 votes
2 answers
2k views

Why is CSRF protection only applicable to web services with browser clients? [duplicate]

The Spring docs state: Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-...
user avatar
2 votes
1 answer
162 views

CORS configuration for service with single browser client

Please note: although I mention Spring Boot (and by proxy, Java) I believe this is a pure HTTP/web development question at heart, and as such, can be answered by anyone with CORS-configuration ...
user avatar
2 votes
1 answer
1k views

How to replace certain backup files on a website every 30 minutes? [closed]

I have a website built with WordPress, unfortunately somebody hacked it several times, deleted my adsense code and put his own adsense. I tried many security techniques, changed database name, did ...
user avatar
1 vote
2 answers
223 views

Hacking attemps from unkown source

I'm running a docker container in Kubernetes cluster running in aws, I exposed the container through LoadBalancer service and limited access to it just to my ip address using aws security groups, but ...
user avatar
  • 53
0 votes
1 answer
523 views

How do I serve a webpage on a local PC without revealing my IP-address to end users? [closed]

Are there any ways to serve a webpage locally without revealing IP to end users?
user avatar
0 votes
2 answers
194 views

API key safety in front end app running in localhost

I have been working on a front end (React) app that sends REST requests to an API end point. I am aware that sensitive items such as API keys should not be stored in front end frameworks (like React, ...
user avatar
  • 145
0 votes
1 answer
289 views

Why must I send certificate and private key when make HTTPS requests? [duplicate]

In my company, we are issued .p12 files and extract the certificate and private key like so: openssl pkcs12 -in path.p12 -out newfile.crt.pem -clcerts -nokeys openssl pkcs12 -in path.p12 -out newfile....
user avatar
1 vote
1 answer
187 views

Based on these HTTPS requests what type of attack is this?

I'm seeing over 1000 attempts to hit my API endpoints with many 500 responses. It seems clear that the would-be attacker is attempting to poke around the APIs, but it isn't clear to me what type of ...
user avatar
1 vote
3 answers
151 views

Exposing different services on the same port

My current project contains multiple heterogeneous TCP servers, but our IT guys have clearly declared that they will give me only one 443 port, which is fair enough. Two options are on the table now. ...
user avatar
1 vote
1 answer
99 views

Are there services to detect data breaches?

There have been quite a lot of data breaches in the past and I wonder how the companies got to know them. Were they only finding it in the news? Did individuals inform them? What about small data ...
user avatar
  • 3,892
0 votes
3 answers
369 views

Making S3 objects viewable only for logged in users

As a service provider, I allow logged in users to upload documents to a web server, and upload it to S3. The logged in user should subsequently be able to view his own documents, and I want to serve ...
user avatar
0 votes
2 answers
106 views

Store cookies for multiple sites on remote server and connect from multiple clients

Would it be secure to: Store all my website cookies (stack sites, webhost, github, web-based email, etc) on a remote server (using an customized open-source VPN or something) Login to the server with ...
user avatar
  • 105
2 votes
2 answers
837 views

Does content-type header having a blank value in the response body, cause any security problem?

I have one HTTP request which is responding with no content value (No response body). Is it necessary to have a content-type header specified for these kinds of responses?
user avatar
1 vote
0 answers
214 views

Detecting a web based MITM attack?

I've been looking into ways to detect a Man In the Middle attack, when the client has "duped" into trusting third party CA. Examples of this are, anti-virus applications and corporate ...
user avatar
  • 11
2 votes
1 answer
176 views

How long does a secret URL need to be?

I'm currently creating a small service where users can upload images (just a free time project). The images are either private, public (unlisted) or public (listed). Now I'm wondering for public ...
user avatar
  • 3,892
1 vote
0 answers
53 views

Abstract data access to user data in large-scale webservices

I am doing research on large-scale webservices and I am trying to understand what common techniques are to prevent user data being accidentally leaked to other logged in users. Especially where end-to-...
user avatar
2 votes
2 answers
886 views

Is CSRF prevention logic required for api that is consumed only by mobile app?

I am developing an ASP.NET Core web api project whose only client will be a mobile app developed in Xamarin. There will be no web frontend for the application. Can CSRF attacks be executed if the ...
user avatar
  • 123
14 votes
3 answers
2k views

Can the Host Header be used to hide the existence of a service?

Imagine a web server running on 93.184.216.34, usually reachable via the public DNS entry example.com. Web servers usually allow the distinction of multiple "virtual" servers, based on the Host header ...
user avatar
0 votes
1 answer
110 views

How do I restrict network access to websites using a monitoring system?

I am making a Java Project a LAB MONITORING SYSTEM for my University practical exams. Where a teacher or admin can monitor some selected computers and can give permissions to what the user at that ...
user avatar
2 votes
1 answer
115 views

SVC service page on production

I am testing web service on production. There is a standard SVC web page available like the example below (another randomly selected webpage, just for example). Is it ok to have this page available on ...
user avatar
  • 1,097
-1 votes
1 answer
122 views

My sql got attacked [closed]

I have a company that has been attacked through SQL and their tables were removed. The attacker put a message replace it with all database entries. The first thing that I did was to figure out if the ...
user avatar
  • 1
0 votes
1 answer
152 views

Got requests to unpublished services. Am I being spied on?

Just today I'm migrating some of my webpages to a new server. After a couple hours the services was ready, I set up a hosts file with my domain example.com pointing to the server address, went to my ...
user avatar
0 votes
0 answers
25 views

I've been an emailed a password; how can I proceed as securely as possible? [duplicate]

I am going through the on-boarding process for a summer internship with a well-known tech/bank company. I've received mail from HR requesting me to fill out an I-9 form via the external service they ...
user avatar
1 vote
2 answers
307 views

Handling of 3rd party OAuth2 tokens

after some extensive research I still don't know how to properly implement the following case. I think this question answers something similar, but I'm not 100% sure (Should client have access to 3rd ...
user avatar
1 vote
1 answer
426 views

Validating API keys in a back-end web-service with very few users

I have run into this scenario a couple of times now but am hoping to get either confirmation that I'm on the right track or a suggestion as to what else should be done. Situation I am building a ...
user avatar
1 vote
0 answers
70 views

How to authorize a subkey using a primary master key pair?

I'm using webcrypto, not PGP/GPG. I would like to use a key pair to create a "subkey" that is authorized by my primary key in a way anyone can publicly verify so I don't need to expose the primary ...
user avatar
  • 313
1 vote
1 answer
178 views

Security Risk of outbound web calls [closed]

What possible risks/attack vectors could be introduced be allowing my server application to make outbound calls to a 3rd party REST API? The 3rd party REST API is off premises and owned and operated ...
user avatar
  • 111
2 votes
0 answers
104 views

Benefit of authentication with a gateway

Given... a public web service with enabled SSL/TLS the web service enforces authentication using JSON Web Tokens a client on a LAN without an Internet connection a proxy on the LAN that grants point-...
user avatar
1 vote
1 answer
302 views

What are the security risks of basic authorization in SOAP requests?

What are the security risks of basic authorization in SOAP requests? I know that the username and password are concatenated and sent in Base64 in an HTTP header on every subsequent request, but it is ...
user avatar
  • 1,097
-1 votes
1 answer
101 views

How to protect my webserver from unauthorized client applications? [duplicate]

I would like to host simple HTTP webservices and develop a web client for it (basic javascript app in the browser). any person (even without registering) shold be able to access the webservices but ...
user avatar
  • 109
1 vote
0 answers
135 views

VPN as a temporary layer of security?

I have a startup working on Django app, that will be processing sensitive personal and financial information. We're just finalizing a prototype of the product (no paying clients, no investors), so we'...
user avatar
  • 11
1 vote
2 answers
357 views

sudo whitelist just program perl

In visudo Ubuntu I whitelist this program myuser ALL=(root) NOPASSWD:/myuser/program.pl when I run sudo /myuser/program.pl I get prompt to set password. The solution is to add to visudo /usr/bin/...
user avatar
0 votes
3 answers
201 views

Self-signed vs. authority issued certificate for internal web services

From an information security perspective, which is best for private (on-premise) micro-services (web services) accessed via HTTPS? Are there an advantages in using certificates signed by a Third ...
user avatar
0 votes
1 answer
122 views

Permissions API [closed]

We are about to develop an integration with an old system which is still live . Due to technical issues it is not possible to augment the data from the old system using the browser so we are going to ...
user avatar
  • 73
1 vote
1 answer
890 views

PCI Compliance 8.2.1, 8.2.3, 8.2.4 - Which user passwords is this talking about?

Say you have an e-commerce site that falls under the SAQ A-EP standard, due to extra content on the same page as the iframe that takes the credit card info. This used to fall under the SAQ A ...
user avatar
  • 13
0 votes
0 answers
162 views

Port scanning - Idle scan 2.0?

I have some server applications and from time to time I'm being victim of some attacks which might be of interest and I'm going to describe in the following. The most recent attack originated from ...
user avatar
  • 111
0 votes
0 answers
157 views

How do I create a secure authentication service which works both for web apps and mobile apps?

As far as I am aware the best way to securely store session data on a client is to use an HTTP-only, secure cookie + HTTPS on a browser and to store a (JWT) token in a secure place for a mobile app. ...
user avatar
1 vote
1 answer
216 views

How to secure embedded code containing REST api call

I am making a Google Analytics like service where you embed generated code into your website and it tracks certain data. I have a backend REST api, but I am not sure how to securely implement a call ...
user avatar
0 votes
3 answers
95 views

Is there a way to protect against fake messages by an SPA that consumes a webservice directly?

I develop a webservice currently and communication might be a bottleneck. It would be at least 100ms faster if I could access the webservice from the browser directly instead of sending the messages ...
user avatar
  • 487
1 vote
1 answer
262 views

URL rewrite spoofable

I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example https://public....
user avatar
0 votes
1 answer
199 views

When should you give up on attempting a xss on part of a website? [closed]

I'm wondering when do you give up on some type of user input to exploit? What are the things that go through your head and that you check off, that makes you think that the input is properly sanitized?...
user avatar

1
2 3 4 5
8