The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [web-service]

A web service is application that provides a standard means of interoperating between different software applications, running on a variety of platforms and/or frameworks - typically using HTTP or HTTPS as a transport layer for object and request models (SOAP, REST, JSON, etc). The output isn't intended to be directly shown in browser.

Filter by
Sorted by
Tagged with
0
votes
3answers
67 views

Self-signed vs. authority issued certificate for internal web services

From an information security perspective, which is best for private (on-premise) micro-services (web services) accessed via HTTPS? Are there an advantages in using certificates signed by a Third ...
0
votes
1answer
81 views

Permissions API [closed]

We are about to develop an integration with an old system which is still live . Due to technical issues it is not possible to augment the data from the old system using the browser so we are going to ...
1
vote
1answer
88 views

PCI Compliance 8.2.1, 8.2.3, 8.2.4 - Which user passwords is this talking about?

Say you have an e-commerce site that falls under the SAQ A-EP standard, due to extra content on the same page as the iframe that takes the credit card info. This used to fall under the SAQ A ...
0
votes
0answers
38 views

Configure gRPC with Burp Suite

I have been given a task to do security auditing of the APIs which are running in gRPC. I am using BloomRPC for querying the gRPC Services. But there so no such option in BloomRPC to proxy the ...
0
votes
0answers
76 views

Port scanning - Idle scan 2.0?

I have some server applications and from time to time I'm being victim of some attacks which might be of interest and I'm going to describe in the following. The most recent attack originated from ...
0
votes
0answers
76 views

How do I create a secure authentication service which works both for web apps and mobile apps?

As far as I am aware the best way to securely store session data on a client is to use an HTTP-only, secure cookie + HTTPS on a browser and to store a (JWT) token in a secure place for a mobile app. ...
1
vote
1answer
45 views

How to secure embedded code containing REST api call

I am making a Google Analytics like service where you embed generated code into your website and it tracks certain data. I have a backend REST api, but I am not sure how to securely implement a call ...
0
votes
3answers
58 views

Is there a way to protect against fake messages by an SPA that consumes a webservice directly?

I develop a webservice currently and communication might be a bottleneck. It would be at least 100ms faster if I could access the webservice from the browser directly instead of sending the messages ...
0
votes
1answer
75 views

URL rewrite spoofable

I am considering using URL rewrites in kubernetes nginx proxy to publish selected context paths in microservices which are run in a cluster running internal services. For example https://public....
0
votes
1answer
85 views

When should you give up on attempting a xss on part of a website? [closed]

I'm wondering when do you give up on some type of user input to exploit? What are the things that go through your head and that you check off, that makes you think that the input is properly sanitized?...
1
vote
1answer
304 views

Swagger on production APIs

What security issues could arise from leaving the Swagger pages on production APIs that expose sensitive data (albeit secured with OAuth)? Are there web crawlers that look to harvest Open API ...
4
votes
3answers
213 views

Distribute Program with Sheets API Credentials

I am trying to write a program that uses the Google Sheets API to read spreadsheets and operate on the data. My program contains a credentials.json file which I obtained from the Java Quickstart page ...
1
vote
2answers
167 views

Letting client encrypt his/her data. How to ensure the client doesn't lose his/her private data?

I am designing a web service where the client is allowed to encrypt his own data on client-side software & then send it to our server, so they can be sure their data is private on our side. Then, ...
0
votes
0answers
303 views

Secure Http Connection With Authentication Header

I am trying to create an authentication header algorithm that can be used for authentication on HTTP server. Not sure it is good but it seems OK to me. I also used similar approaches for previous WS ...
0
votes
2answers
104 views

Using device fingerprint to prevent an attacker from calling my login REST service for doing dictionary attacks, is this an effective solution?

As you know, REST services of mobile application are vulnerable from calling by other unauthorized users, some attacks can be done, and we don't have any prevention mechanism for them, such as ...
0
votes
1answer
49 views

Whats should be TRACE response of an API (if it is not allowed on server)?

I am testing a website and noticed that when I change the GET method of the API request to TRACE, it returns an error 405-Method not allowed in Burp repeater. That's fine. The problem is, lots of ...
1
vote
1answer
78 views

Can I use a JWT for both Authentication & Data Transmission

I think I have a high level understanding of what a JWT is and how it works. I would now like to apply it to a use case, namely that the token would be used for authentication purposes, and passing ...
0
votes
0answers
41 views

what would be the best approach to generate JWT token for server to server communications?

I am planning to develop an authentication service which generates and validates the JWT token for incoming requests. What would be the best challenge mechanism which could be employed to generate the ...
5
votes
1answer
340 views

How can I find a web application's document root using a path traversal vulnerability?

I am performing a penetration testing on an application hosted on an Ubuntu environment. So using a path traversal vulnerability, I can download any file. The API web application runs as root (...
0
votes
1answer
133 views

Device authentication, common method

My question is: What are some standard device authentication methods, in a scenario when: The desktop computer is being authenticated on web service I provide the .exe on the desktop I control the ...
2
votes
1answer
127 views

Big insurance website exposing StackTrace of Java JSON Parser

Recently I coincidentally have discovered that an api endpoint of an insurance company is sending a StackTrace of a JSON parser as response to a http POST message with bad formatted JSON in the ...
1
vote
0answers
53 views

Securing internal API credentials on a public chrome extension

I've developed a Chrome extension that I plan to publish to the Chrome Web Store. On the server side, I've implemented OAuth 2 (using access tokens and refresh tokens) with support for generation of ...
-2
votes
3answers
193 views

Why do services that use 2-factor authentication still ask you to provide a password?

The idea of 2 factor authentication is that if you can prove that you have both a password and a device, you are trusted to be who you say you are. My question is, why does the service still ask you ...
2
votes
2answers
646 views

Is it worth storing email addresses as hashes?

If your running a web services with lots of users and you get hacked, you may be giving away users's plain text information like email and hashes like password hashes. Is it worth storing email ...
0
votes
1answer
25 views

Can I get the forwarder IP from the WAF? (when a website redirects a user, and I want the website's IP)

I guess that I'm sending a token to a web server, they use my token to redirect a user to my website and the user uses my website. Now, using a WAF and setting x-forwarded-for I can get the IP of the ...
1
vote
0answers
51 views

Tunelling an Authenticated User Across Microservices Securely

On a platform which follows the OAuth 2.0 framework for authorization and a microserivce based architecture, what is a secure way to pass a user from one microservice to another on the same platform ...
1
vote
1answer
270 views

CORS accepting arbitrary origin with GET but not with OPTIONS

I'm testing an API, which allows an arbitrary origin on POST/GET requests, by responding with the CORS header Access-Control-Allow-Origin: *. However, with OPTIONS requests and an arbitrary origin, ...
0
votes
2answers
87 views

Web App or Web Services testing?

I am trying to clear up a doubt on security testing. If the web app (GUI, functional UIs, user roles, et all), makes use of rest web services to take actions, I believe both the web app AND the web ...
2
votes
0answers
380 views

ASP.NET SOAP Service XXE

Is it possible to do any type of XXE in a service developed using default C# SOAP service framework? I ask because any type of XXE payload I try to add, even XML header, whatever I add before SOAP ...
4
votes
3answers
220 views

What benefit do Captchas provide?

I have researched and found the following sites which will break captchas: anticaptcha 2captcha (links not included to prevent promoting the sites) Given that these services can be used to break ...
2
votes
1answer
81 views

CSRF Testing. Validation Error 422. Locale Required

So I'm testing this site for coursework and I think it might be vulnerable CSRF however when I try to make a post request I get a validation error which says "locale" is required despite me specifying ...
15
votes
3answers
4k views

Is this bank website secure enough? No https in login page

Today I opened a bank account to invest my savings. Here's the link to the login page: http://www1.directatrading.com/ I noticed it doesn't use Https protocol (neither is that page nor in the landing ...
4
votes
3answers
152 views

Are there security concerns when using popular (js) frameworks?

To what extent should one trust web/js frameworks? Most frameworks are open source - developed in the open. Hence, many people can semi anonymously commit to the project. Human validation might be ...
1
vote
1answer
75 views

How to hide folders inside webroot from being identified?

I have a library inside my webroot: https://my-website.com/wp-content/my-library-i-want-to-hide Accessing the url via a browser gives me the expected permission denied error. However, I want to make ...
0
votes
1answer
247 views

Can mp3 files be malicious? [duplicate]

I have an old computer that I don't use for anything important or sensitive. I occasionally download music on this old computer and transfer the mp3 files from a usb onto my primary computer. These ...
1
vote
1answer
3k views

Damage of a leaked ETag

I've read multiple times that leaked ETags from Webservers are considered an information leakage vulnerability. For example in the server response headers: ETag: X/"1234-56789" But I have not found ...
0
votes
3answers
484 views

Is “Please update/confirm your email address” actually helpful?

Steam just asked me "Is this still your email address? [email_address_here]" This is an on-PC app that I trust, so I'm 100% confident of its legitimacy. I would like to know about its usefulness. ...
1
vote
2answers
198 views

Web Service Authentication Using PBKDF2 and a Public Salt - Does the salt need to change on every request?

I have implemented PBKDF2 authentication for some web services. The client is given the following information, so they can duplicate the PBKDF2 function: the hashing algorithm (SHA256) a secret ...
39
votes
4answers
10k views

What does the tilde (~) mean at the end of a file extension? [closed]

While I was playing some Capture the Flag (CTF), I couldn't solve a challenge because of this tilde ~. I'm playing on www.example.com/index.php but when I added (~) at the end: www.example.com/index....
6
votes
2answers
6k views

Do I need to hash or encrypt API keys before storing them in a database?

I'm securing API calls to a REST service I'm building using API Keys. The plan is to: When we get a new client, generate an API Key (a UUID). Email the API key to them. They send the API key on every ...
2
votes
2answers
119 views

How can I verify that network calls to my API come only from my C# program?

I have a desktop application build on the .Net framework. If I obfuscate the code, even if somebody reverse-engineers the code and tries to call my API using the altered source, can I know if the API ...
3
votes
1answer
843 views

Why isn't Secure Remote Password protocol being used in REST APIs?

I have seen a few samples of SRP protocol used for web applications and I wonder why nobody ever uses it for RESTful authentication. I have done some research and I couldn't find any single example, ...
3
votes
2answers
382 views

Is authentication + authorization a good idea at gateway level when using microservices?

I have this simple design: --------- ------------- ----> Queries ----> Gateway ---- RPC ----> Microservices --------- -------...
2
votes
2answers
66 views

Does a domain alias give any security against hackers?

We have an app which runs off of a private API. We have a server which hosts the API, as well as an admin panel where staff can log in and make changes to the app's content. The API and admin panel ...
4
votes
1answer
249 views

Is using online SQL prettifiers considered safe?

From time to time when debugging SQL queries, we use online SQL prettifiers (e.g. this one) that reindent and properly format the queries to increase readability. Can this potentially be a source of ...
0
votes
1answer
74 views

Sending server side credentials as plaintext after connecting to SSL [duplicate]

I am creating an Android application to interact with a webservice. Is it fine if I transmit the server side api credentials as plaintext that is used to authenticate a webservice? The application ...
14
votes
10answers
8k views

Spoofing POST/GET requests in a RESTful service

I started working on an app that connects to a RESTful service for authentication and data. User POSTs the user name and password to /token endpoint. Once they log in successfully, they get a bearer ...
5
votes
2answers
2k views

OWASP Secure Headers for Web Services

Is the following headers mandatory for a web service that handles POST requests and return data using SOAP? HTTP Strict Transport Security (HSTS) X-Frame-Options X-XSS-Protection X-Content-Type-...
6
votes
1answer
681 views

Understanding CSRF attack prevention

I've read multiple topics about web-specific attacks and preventions, but I'm still not sure if I got the point. Let's imagine that we have a website (myapp.com) and a web service (myapi.com). The ...
0
votes
2answers
272 views

Are JSON web services vulnerable to CORF attacks?

Is a web service vulnerable to CSRF attack if the following are true? GET/OPTIONS Requests are Rejected Token is used for Authentication, Without token we cant access the application Access-...