Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [web-service]

A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't intended to be directly shown in browser.

1
vote
1answer
98 views

Swagger on production APIs

What security issues could arise from leaving the Swagger pages on production APIs that expose sensitive data (albeit secured with OAuth)? Are there web crawlers that look to harvest Open API ...
2
votes
1answer
53 views
+100

Distribute Program with Sheets API Credentials

I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data. My program contains a credentials.json file which I obtained from the Java Quickstart page ...
1
vote
2answers
154 views

Letting client encrypt his/her data. How to ensure the client doesn't lose his/her private data?

I am designing a web service where the client is allowed to encrypt his own data on client-side software & then send it to our server, so they can be sure their data is private on our side. Then, ...
0
votes
0answers
132 views

Secure Http Connection With Authentication Header

I am trying to create an authentication header algorithm that can be used for authentication on HTTP server. Not sure it is good but it seems OK to me. I also used similar approaches for previous WS ...
0
votes
2answers
83 views

Using device fingerprint to prevent an attacker from calling my login REST service for doing dictionary attacks, is this an effective solution?

As you know, REST services of mobile application are vulnerable from calling by other unauthorized users, some attacks can be done, and we don't have any prevention mechanism for them, such as ...
0
votes
1answer
46 views

Whats should be TRACE response of an API (if it is not allowed on server)?

I am testing a website and noticed that when I change the GET method of the API request to TRACE, it returns an error 405-Method not allowed in Burp repeater. That's fine. The problem is, lots of ...
1
vote
1answer
64 views

Can I use a JWT for both Authentication & Data Transmission

I think I have a high level understanding of what a JWT is and how it works. I would now like to apply it to a use case, namely that the token would be used for authentication purposes, and passing ...
0
votes
0answers
35 views

what would be the best approach to generate JWT token for server to server communications?

I am planning to develop an authentication service which generates and validates the JWT token for incoming requests. What would be the best challenge mechanism which could be employed to generate the ...
5
votes
1answer
238 views

How can I find a web application's document root using a path traversal vulnerability?

I am performing a penetration testing on an application hosted on an Ubuntu environment. So using a path traversal vulnerability, I can download any file. The API web application runs as root (...
0
votes
1answer
112 views

Device authentication, common method

My question is: What are some standard device authentication methods, in a scenario when: The desktop computer is being authenticated on web service I provide the .exe on the desktop I control the ...
2
votes
1answer
96 views

Big insurance website exposing StackTrace of Java JSON Parser

Recently I coincidentally have discovered that an api endpoint of an insurance company is sending a StackTrace of a JSON parser as response to a http POST message with bad formatted JSON in the ...
1
vote
0answers
31 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
-2
votes
3answers
170 views

Why do services that use 2-factor authentication still ask you to provide a password?

The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...
2
votes
2answers
425 views

Is it worth storing email addresses as hashes?

If your running a web services with lots of users and you get hacked, you may be giving away users's plain text information like email and hashes like password hashes. Is it worth storing email ...
0
votes
1answer
24 views

Can I get the forwarder IP from the WAF? (when a website redirects a user, and I want the website's IP)

I guess that I'm sending a token to a web server, they use my token to redirect a user to my website and the user uses my website. Now, using a WAF and setting x-forwarded-for I can get the IP of the ...
1
vote
0answers
51 views

Tunelling an Authenticated User Across Microservices Securely

On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
1
vote
1answer
175 views

CORS accepting arbitrary origin with GET but not with OPTIONS

I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *. However, with OPTIONS requests and an arbitrary origin, ...
0
votes
2answers
85 views

Web App or Web Services testing?

I am trying to clear up a doubt on security testing. If the web app (GUI, functional UIs, user roles, et all), makes use of rest web services to take actions, I believe both the web app AND the web ...
2
votes
0answers
316 views

ASP.NET SOAP Service XXE

Is it possible to do any type of XXE in a service developed using default C# SOAP service framework? I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
4
votes
3answers
208 views

What benefit do Captchas provide?

I have researched and found the following sites which will break captchas: anticaptcha 2captcha (links not included to prevent promoting the sites) Given that these services can be used to break ...
0
votes
0answers
40 views

What is the best way to track a logged in user?

We have a client/server app where the client is the browser running our JavaScript app and the server side is an ASP.NET app presenting a RESTful API. We presently have 1 instance of the server, but ...
2
votes
1answer
80 views

CSRF Testing. Validation Error 422. Locale Required

So I'm testing this site for coursework and I think it might be vulnerable CSRF however when I try to make a post request I get a validation error which says "locale" is required despite me specifying ...
15
votes
3answers
4k views

Is this bank website secure enough? No https in login page

Today I opened a bank account to invest my savings. Here's the link to the login page: http://www1.directatrading.com/ I noticed it doesn't use Https protocol (neither is that page nor in the landing ...
4
votes
3answers
150 views

Are there security concerns when using popular (js) frameworks?

To what extent should one trust web/js frameworks? Most frameworks are open source - developed in the open. Hence, many people can semi anonymously commit to the project. Human validation might be ...
1
vote
1answer
66 views

How to hide folders inside webroot from being identified?

I have a library inside my webroot: https://my-website.com/wp-content/my-library-i-want-to-hide Accessing the url via a browser gives me the expected permission denied error. However, I want to make ...
0
votes
1answer
144 views

Can mp3 files be malicious? [duplicate]

I have an old computer that I don't use for anything important or sensitive. I occasionally download music on this old computer and transfer the mp3 files from a usb onto my primary computer. These ...
1
vote
1answer
1k views

Damage of a leaked ETag

I've read multiple times that leaked ETags from Webservers are considered an information leakage vulnerability. For example in the server response headers: ETag: X/"1234-56789" But I have not found ...
0
votes
3answers
358 views

Is “Please update/confirm your email address” actually helpful?

Steam just asked me "Is this still your email address? [email_address_here]" This is an on-PC app that I trust, so I'm 100% confident of its legitimacy. I would like to know about its usefulness. ...
1
vote
2answers
178 views

Web Service Authentication Using PBKDF2 and a Public Salt - Does the salt need to change on every request?

I have implemented PBKDF2 authentication for some web services. The client is given the following information, so they can duplicate the PBKDF2 function: the hashing algorithm (SHA256) a secret ...
38
votes
4answers
9k views

What does the tilde (~) mean at the end of a file extension? [closed]

While I was playing some Capture the Flag (CTF), I couldn't solve a challenge because of this tilde ~. I'm playing on www.example.com/index.php but when I added (~) at the end: www.example.com/index....
4
votes
2answers
4k views

Do I need to hash or encrypt API keys before storing them in a database?

I'm securing API calls to a REST service I'm building using API Keys. The plan is to: When we get a new client, generate an API Key (a UUID). Email the API key to them. They send the API key on every ...
2
votes
2answers
118 views

How can I verify that network calls to my API come only from my C# program?

I have a desktop application build on the .Net framework. If I obfuscate the code, even if somebody reverse-engineers the code and tries to call my API using the altered source, can I know if the API ...
3
votes
1answer
773 views

Why isn't Secure Remote Password protocol being used in REST APIs?

I have seen a few samples of SRP protocol used for web applications and I wonder why nobody ever uses it for RESTful authentication. I have done some research and I couldn't find any single example, ...
3
votes
2answers
314 views

Is authentication + authorization a good idea at gateway level when using microservices?

I have this simple design: --------- ------------- ----> Queries ----> Gateway ---- RPC ----> Microservices --------- -------...
2
votes
2answers
54 views

Does a domain alias give any security against hackers?

We have an app which runs off of a private API. We have a server which hosts the API, as well as an admin panel where staff can log in and make changes to the app's content. The API and admin panel ...
4
votes
1answer
247 views

Is using online SQL prettifiers considered safe?

From time to time when debugging SQL queries, we use online SQL prettifiers (e.g. this one) that reindent and properly format the queries to increase readability. Can this potentially be a source of ...
0
votes
1answer
71 views

Sending server side credentials as plaintext after connecting to SSL [duplicate]

I am creating an Android application to interact with a webservice. Is it fine if I transmit the server side api credentials as plaintext that is used to authenticate a webservice? The application ...
14
votes
10answers
7k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
5
votes
2answers
2k views

OWASP Secure Headers for Web Services

Is the following headers mandatory for a web service that handles POST requests and return data using SOAP? HTTP Strict Transport Security (HSTS) X-Frame-Options X-XSS-Protection X-Content-Type-...
6
votes
1answer
585 views

Understanding CSRF attack prevention

I've read multiple topics about web-specific attacks and preventions, but I'm still not sure if I got the point. Let's imagine that we have a website (myapp.com) and a web service (myapi.com). The ...
0
votes
2answers
248 views

Are JSON web services vulnerable to CORF attacks?

Is a web service vulnerable to CSRF attack if the following are true? GET/OPTIONS Requests are Rejected Token is used for Authentication, Without token we cant access the application Access-...
1
vote
1answer
58 views

Security difference between web tokens and message signing

I'm seeing two different types of authentication being widely used, with one being far more complex than the other. One are the simple session ID tokens used in most websites (user sends login info, ...
2
votes
1answer
103 views

Secure, Portable Bookmarks

A constant bugbear is my bookmarks being synced to my Google accounts, meaning access to them outside that Google account requires various manual steps. So it got me thinking of a roll your own way ...
0
votes
1answer
364 views

How exploitable is a QR code in a login system?

I'm taking a CTF challenge on a web service. The goal is to gather the most information possible of a user. I have access to it's login and password, but password is expired and the account must be ...
0
votes
3answers
1k views

What is untrusted data

I was reading the basics of XSS prevention on owasp xss rules. But the issue is rather abstract. The term "untrusted data" is often used. Every rule reminds not to insert untrasted data in the certain ...
1
vote
2answers
81 views

How (un)safe is it to protect an admin page with a simple query-string password? [duplicate]

I have a very simple admin web page that simply displays feedback messages left by users of my mobile app. The messages are sent from the app to a web server, and to view the messages one needs to ...
0
votes
2answers
149 views

Does CVE-2017-8759 impact the web service?

I saw lots of information on the impact to end user PC, but didn't see anywhere explain the impact to the cloud service. If the issue is from the SOAP WSDL parsing, seems like the web service can also ...
1
vote
2answers
293 views

User name and password is passed in custom headers

Is it safe to pass username and password in two separate custom header tags in Web services/Web application Post request over https. How is it different from using from Authorization header. Which ...
1
vote
2answers
127 views

Preventing malicious usage from users with access tokens

So I have a web page running a JavaScript application, and a web service that the application makes HTTP PUT requests against. The service uses access tokens to verify the user’s identity, but now I’m ...
0
votes
2answers
136 views

How do online banking applications work? [closed]

It's suprisingly hard to find concrete information about that topic. I've worked with the Flask framework lately and I just managed to create a proper login that stores the passwords in a database ...