Skip to main content
3 votes
Accepted

Can we prevent DDoS or spam form submission with client authentication?

tl/dr: Client authentication in the browser is useless because browser-based bots will automatically authenticate themselves, and browser-less bots will get stopped by much simpler methods anyway. ...
Conor Mancone's user avatar
3 votes
Accepted

Security considerations of consuming public API

On top of what others have mentioned, I would suggest to follow these guidelines: Third Party Schema Validation If the third party has a published swagger / OpenAPI schema and they have defined the ...
NaorP's user avatar
  • 304
3 votes

What's the difference between an API gateway and XML gateway?

A bit of an artificial distinction in my view. I am guessing that they are considering XML gateways to be document-based whereas they are considering API gateways to be record based. But this really ...
Julian Knight's user avatar
3 votes
Accepted

OAuth2 Implicit Flow: Possible Attack Vectors of Refreshing Token via CORS?

Instead of going with a completely different approach that as you mentioned would warrant a more thorough review from a security standpoint I would suggest leveraging what's already specified in ...
João Angelo's user avatar
3 votes
Accepted

Would a reverse-proxy authentication server be a secure setup?

Reverse Proxies are pretty common for what you are asking. Quite a few companies make servers designed for what your asking so you could use that as a reference. For instance, I've used WebSeal (IBM ...
Shane Andrie's user avatar
  • 3,850
2 votes

Rest API Security Guideline. Developer Rules?

Depending on your approach to delivering software, I believe the implementation of this can take different forms. I appreciate your question was looking for something concrete, and perhaps this is a ...
Joe's user avatar
  • 121
2 votes

How I can enumerate all endpoints of an API?

From the outside, there's no generic method. A site can have as many (possibly obfuscated) endpoints as they wish. You could, however, get lucky if there is an automatically generated site-map; it ...
S.L. Barth is on codidact.com's user avatar
2 votes

Security considerations of consuming public API

To expand on the above answers by @mhr and @Raimonds-Liepiņš: Validate Data Meticulously validate all data pulled from the public API. Any text or "unknown" data must be filtered through a Security ...
phbits's user avatar
  • 1,072
2 votes

Security considerations of consuming public API

Here are a few tips: Check if there have been any major security issues with the third party API you are using Treat the data coming in from the API the same as you would treat any user input Make ...
Raimonds Liepiņš's user avatar
2 votes

How to use Oauth2 and JWT to secure microservice architecture?

Why are you saying that every request must go through Auth Server ? Only the first request (login request) until the JWT token is expired is handled by Auth Server. After that your API must be able to ...
David Magalhães's user avatar
2 votes
Accepted

Can API Security/WAF tools decrypt "mirrored" traffic?

Since out of band analysis can not manipulate the traffic to create an active man in the middle attack, it would need to have access to the keys of the existing TLS connection. But every TLS ...
Steffen Ullrich's user avatar
1 vote

Decorating headers after JWT authentication

This is not, inherently, a bad idea. The main thing that protects against an attacker spoofing the authentication internally is the mTLS; if you authenticate each service independently to each other ...
CBHacking's user avatar
  • 52.2k
1 vote
Accepted

Should resource servers behind an API gateway independently verify authentication claims?

It all depends on what each company considers to be enough security for them. The stated approach of only verifying at the border may be enough. An security-in-depth approach as you prefer would ...
Ángel's user avatar
  • 19.1k
1 vote
Accepted

Does "validating" a JWT token from prove authentication with OpenId?

Given enough time and money, anything can be spoofed. The real risk is the disclosure of the private key allowing forged data to be signed. Signed JWTs use RSA private keys to sign the data (JWT ...
John Hanley's user avatar
1 vote
Accepted

How can API documentation helpful to exploit any application?

If you have an internal administration portal that only the Human Resources department has access to, and that portal is a web application that talks to its API, then the people working in HR would be ...
Luc's user avatar
  • 33.1k
1 vote

How can API documentation helpful to exploit any application?

This question is quite vague. A service's API documentation is for end-users to utilize its service, it has information such as how to retrieve data, send data, store data, access data, manipulate ...
mallocation's user avatar
  • 1,676
1 vote
Accepted

Rest API Security Guideline. Developer Rules?

As always when the subject is web security, you should start with OWASP resources: https://cheatsheetseries.owasp.org/cheatsheets/REST_Assessment_Cheat_Sheet.html (This answer was previously a ...
A. Hersean's user avatar
  • 10.7k
1 vote

Would a reverse-proxy authentication server be a secure setup?

This is a great setup. Look into google's beyond corp documentation to learn more about how they think about networks and this type of access. https://cloud.google.com/beyondcorp/ If you do want to ...
Jonathan's user avatar
  • 2,386
1 vote

Security considerations of consuming public API

Unrelated of consuming an API or accepting user input, it is good practice not to trust the data without checking it. Therefore you should validate, that the data looks like whatever you expect it ...
mhr's user avatar
  • 339

Only top scored, non community-wiki answers of a minimum length are eligible