Skip to main content
Share Your Experience: Take the 2024 Developer Survey
143 votes
Accepted

Why can't I just let customers connect directly to my database?

TL,DR: Don't. (My-)SQL permissions are pretty fine-grained, so I'd wager there shouldn't be any obvious security issues Even with permission on the record level, it does not scale easy. If a user ...
ThoriumBR's user avatar
  • 54.4k
97 votes
Accepted

How do hackers trick frontend validation?

I think you are very confused about what both CORS and SOP do... neither is relevant to these attacks at all. There are lots of ways to bypass client-side validation. HTTP is just a stream of bytes, ...
CBHacking's user avatar
  • 48.9k
88 votes
Accepted

Is exposing the server time a security risk?

The server time is of little use to an attacker, generally, as long as it is accurate. In fact, what is being revealed is not the current time (after all, barring relativistic physics, time is ...
forest's user avatar
  • 66.8k
88 votes
Accepted

Preventing users from tampering with input

TL,DR: It's impossible to do so client side. Client side validation is just a client convenience, not useful to really validate anything. You don't want the client to mistype his email, putting an ...
ThoriumBR's user avatar
  • 54.4k
83 votes
Accepted

Returning the wrong HTTP response code on purpose?

Has anyone ever thought about doing this? Yes, there was actually a talk about exactly this at defcon 21 (video, slides). Their conclusion was that working with response codes as offensive security ...
tim's user avatar
  • 29.6k
70 votes
Accepted

What stops a malicious user from hitting an endpoint with falsified data from the console of a webpage?

While Garret Albright provided a suggestion for this particular case, I think it's important to stress the underlying problem: Nothing prevents the user from sending fake data to the API. This is why ...
Ja1024's user avatar
  • 7,457
69 votes

Why can't I just let customers connect directly to my database?

Interesting question. In theory, this can be done securely. MS-SQL can secure the connection with encryption, authenticate the user, and provides fine-grained permissions and other security features ...
paj28's user avatar
  • 33.4k
60 votes

Returning the wrong HTTP response code on purpose?

It won't actually slow down an attacker any appreciable amount, but will cause any future developers who work on your platform to be really annoyed at you. It may also cause certain nice features of ...
Xiong Chiamiov's user avatar
60 votes

Why can't I just let customers connect directly to my database?

I've built both RESTful interfaces and provided customers with direct SQL access. The problem here is that the question is fundamentally flawed: Lots of the work backend developers do is providing ...
NPSF3000's user avatar
  • 700
51 votes
Accepted

Protect API from being tampered?

What if the attacker decides to tamper the "from:id" such that it could send arbitrary messages to anyone from any user? Create a session, and use the session identifier as identifier, not the user ...
vidarlo's user avatar
  • 16.5k
50 votes
Accepted

Security Headers for a web API

Checking headers off a list is not the best technique to assert a site's security. Services like securityheaders.io can point you in the right direction but all they do is compare against a list of ...
Arminius's user avatar
  • 44.8k
41 votes
Accepted

Securing API keys for a Twitter account for a program to be run on other PC's

As specified, the problem is completely impossible. You can not, and should not attempt to, make a program - much less a script - do something its user can't see. There are many ways the attacker ...
CBHacking's user avatar
  • 48.9k
37 votes

Why can't I just let customers connect directly to my database?

Performance You say that performance should be "way better", except that now you've just given malicious actors complete authority to wreck the performance of your DB. Of course, they have to ...
Lawnmower Man's user avatar
31 votes
Accepted

What kind of hashing to use for storing REST API tokens in the database?

TLDR; SHA256 is good enough To answer this we need to look at why we salt, hash, and use multiple iterations of the hash, in the first place; Why do we salt? To protect users that have weak password ...
Hybrid's user avatar
  • 4,228
31 votes

What is PKCE actually protecting?

The reason PKCE is important is that on mobile OS, the OS allows apps to register to handle redirect URIs so a malicious app can register and receive redirects with the authorization code for ...
Grokify's user avatar
  • 599
28 votes
Accepted

Spoofing POST/GET requests in a RESTful service

My question is what prevents users from intercepting their regular post form the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to ...
Hector's user avatar
  • 10.9k
27 votes
Accepted

Public API with authorization token -- is it possible to protect the demo token?

As Steffen has said you cannot protect the token from users. I'd just like to add a suggestion for a more general scenario of having a "demo" Api. It sounds like your API doesn't have any stored ...
GreatSeaSpider's user avatar
25 votes
Accepted

How do you pen test a REST API?

REST Security and API Security are excellent topics of research. This question and the answers provide good starting points to find great tools and techniques to test these interfaces -- API Security ...
atdre's user avatar
  • 19.1k
25 votes
Accepted

Is it possible to ensure client data is correct?

To put it simply: There is NO way As you already determined, a request can easily be forged. Even if using a custom encryption, your users can decompile your code and find out how it's done. The ...
dmuensterer's user avatar
  • 1,184
25 votes

Preventing users from tampering with input

You'll have to validate it on the server side. You say that the number of possible permutations is too large - but the client side somehow did it, didn't it? If the server side doesn't have enough ...
Vilx-'s user avatar
  • 1,040
24 votes
Accepted

Store Auth-Token in Cookie or Header?

Cookie Based Authentication Pros HttpOnly Flag: Session cookies can be created with the HttpOnly flag which secures the cookies from malicious JavaScript (XSS-Cross-Site Scripting). Secure flag: ...
Shiv Sahni's user avatar
23 votes
Accepted

What is PKCE actually protecting?

This write-up Okta has on this subject explains this pretty well IMHO. I believe it's because PKCE is intended for native applications (e.g. Android, iOS, UWP, Electron, etc.) where you leave the ...
someone1's user avatar
  • 766
23 votes

Do I need to hash or encrypt API keys before storing them in a database?

Yes, you should absolutely hash your API keys. In effect, they are your passwords and should be treated as such. And note that's hashed - not encrypted. You never need to decrypt the API keys, hence ...
Anders's user avatar
  • 65.6k
23 votes

How do hackers trick frontend validation?

Maybe a very short answer will help as well. I never thought about it much, I just thought this meant someone could bypass the validations by making a request on something like Postman. But then I ...
Vincent's user avatar
  • 329
21 votes

Store Auth-Token in Cookie or Header?

The accepted answer is conflating session based authentication - where a session is maintained in backend database and is stateful with cookies, which are a transport mechanism and so the pros and ...
Melbourne2991's user avatar
21 votes

What stops a malicious user from hitting an endpoint with falsified data from the console of a webpage?

You have the server store the date and time that the puzzle is requested by the browser, then have the client-side code submit the solution that the user found to the server, not the amount of time it ...
Garrett Albright's user avatar
19 votes

Why can't I just let customers connect directly to my database?

This could be a reasonable approach in certain circumstances: The customer gets read-only access. They get read access to an entire database: it's either quasi-public data to all your customers, or ...
poolie's user avatar
  • 303
18 votes

OIDC Flow for SPA and RESTful API

Here is the difference between Implicit Flow and AuthCode Flow: Implicit Flow NOTE: As of April 2019, the Oauth Working Group no longer recommends the use of Implicit Flow for most cases because there ...
Moshe Katz's user avatar
  • 1,360
18 votes
Accepted

Is a backend API server vulnerable to CSRF?

Our application is a pure backend server. Serving JSON APIs to the users. Users will be calling these APIs from their backend in 99.99% of the cases. ... It does not matter what the API is serving or ...
Steffen Ullrich's user avatar
16 votes
Accepted

What is the difference between API keys and API tokens usages?

API keys are public, by intent. They are an authorisation mechanism, not an authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how ...
schroeder's user avatar
  • 130k

Only top scored, non community-wiki answers of a minimum length are eligible