Hot answers tagged

143 votes
Accepted

Why can't I just let customers connect directly to my database?

TL,DR: Don't. (My-)SQL permissions are pretty fine-grained, so I'd wager there shouldn't be any obvious security issues Even with permission on the record level, it does not scale easy. If a user ...
user avatar
  • 50.5k
97 votes
Accepted

How do hackers trick frontend validation?

I think you are very confused about what both CORS and SOP do... neither is relevant to these attacks at all. There are lots of ways to bypass client-side validation. HTTP is just a stream of bytes, ...
user avatar
  • 38.7k
89 votes
Accepted

Is exposing the server time a security risk?

The server time is of little use to an attacker, generally, as long as it is accurate. In fact, what is being revealed is not the current time (after all, barring relativistic physics, time is ...
user avatar
  • 64k
87 votes
Accepted

Preventing users from tampering with input

TL,DR: It's impossible to do so client side. Client side validation is just a client convenience, not useful to really validate anything. You don't want the client to mistype his email, putting an ...
user avatar
  • 50.5k
85 votes
Accepted

Returning the wrong HTTP response code on purpose?

Has anyone ever thought about doing this? Yes, there was actually a talk about exactly this at defcon 21 (video, slides). Their conclusion was that working with response codes as offensive security ...
user avatar
  • 29k
68 votes

Why can't I just let customers connect directly to my database?

Interesting question. In theory, this can be done securely. MS-SQL can secure the connection with encryption, authenticate the user, and provides fine-grained permissions and other security features ...
user avatar
  • 32.6k
62 votes

Returning the wrong HTTP response code on purpose?

It won't actually slow down an attacker any appreciable amount, but will cause any future developers who work on your platform to be really annoyed at you. It may also cause certain nice features of ...
user avatar
58 votes

Why can't I just let customers connect directly to my database?

I've built both RESTful interfaces and provided customers with direct SQL access. The problem here is that the question is fundamentally flawed: Lots of the work backend developers do is providing ...
user avatar
  • 680
51 votes
Accepted

Protect API from being tampered?

What if the attacker decides to tamper the "from:id" such that it could send arbitrary messages to anyone from any user? Create a session, and use the session identifier as identifier, not the user ...
user avatar
  • 12.6k
41 votes
Accepted

Security Headers for a web API

Checking headers off a list is not the best technique to assert a site's security. Services like securityheaders.io can point you in the right direction but all they do is compare against a list of ...
user avatar
  • 43.6k
41 votes
Accepted

Securing API keys for a Twitter account for a program to be run on other PC's

As specified, the problem is completely impossible. You can not, and should not attempt to, make a program - much less a script - do something its user can't see. There are many ways the attacker ...
user avatar
  • 38.7k
37 votes

Why can't I just let customers connect directly to my database?

Performance You say that performance should be "way better", except that now you've just given malicious actors complete authority to wreck the performance of your DB. Of course, they have to ...
user avatar
29 votes
Accepted

Spoofing POST/GET requests in a RESTful service

My question is what prevents users from intercepting their regular post form the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to ...
user avatar
  • 10.9k
29 votes

What is PKCE actually protecting?

The reason PKCE is important is that on mobile OS, the OS allows apps to register to handle redirect URIs so a malicious app can register and receive redirects with the authorization code for ...
user avatar
  • 509
27 votes
Accepted

How does a refresh token help?

The main advantage of a refresh token is that it is easier to detect if it is compromised. Consider these two scenarios: A single long-lasting auth token is used. A short duration auth token is used,...
user avatar
  • 9,122
27 votes
Accepted

Public API with authorization token -- is it possible to protect the demo token?

As Steffen has said you cannot protect the token from users. I'd just like to add a suggestion for a more general scenario of having a "demo" Api. It sounds like your API doesn't have any stored ...
user avatar
25 votes
Accepted

How do you pen test a REST API?

REST Security and API Security are excellent topics of research. This question and the answers provide good starting points to find great tools and techniques to test these interfaces -- API Security ...
user avatar
  • 18.9k
25 votes
Accepted

What kind of hashing to use for storing REST API tokens in the database?

TLDR; SHA256 is good enough To answer this we need to look at why we salt, hash, and use multiple iterations of the hash, in the first place; Why do we salt? To protect users that have weak password ...
user avatar
  • 4,138
25 votes

Preventing users from tampering with input

You'll have to validate it on the server side. You say that the number of possible permutations is too large - but the client side somehow did it, didn't it? If the server side doesn't have enough ...
user avatar
  • 996
23 votes
Accepted

Store Auth-Token in Cookie or Header?

Cookie Based Authentication Pros HttpOnly Flag: Session cookies can be created with the HttpOnly flag which secures the cookies from malicious JavaScript (XSS-Cross-Site Scripting). Secure flag: ...
user avatar
23 votes

How do hackers trick frontend validation?

Maybe a very short answer will help as well. I never thought about it much, I just thought this meant someone could bypass the validations by making a request on something like Postman. But then I ...
user avatar
  • 329
21 votes
Accepted

Is it possible to ensure client data is correct?

To put it simply: There is NO way As you already determined, a request can easily be forged. Even if using a custom encryption, your users can decompile your code and find out how it's done. The ...
user avatar
  • 1,134
19 votes

Why can't I just let customers connect directly to my database?

This could be a reasonable approach in certain circumstances: The customer gets read-only access. They get read access to an entire database: it's either quasi-public data to all your customers, or ...
user avatar
  • 303
18 votes
Accepted

How does including a magic prefix to a JSON response work to prevent XSSI attacks?

XSSI works by trying to evaluate a JSON response as Javascript and the sequence )]}' prevents this by reliably producing a syntax error. There have been different proposed countermeasures against ...
user avatar
  • 43.6k
18 votes

OIDC Flow for SPA and RESTful API

Here is the difference between Implicit Flow and AuthCode Flow: Implicit Flow NOTE: As of April 2019, the Oauth Working Group no longer recommends the use of Implicit Flow for most cases because there ...
user avatar
  • 1,331
18 votes
Accepted

What is PKCE actually protecting?

This write-up Okta has on this subject explains this pretty well IMHO. I believe it's because PKCE is intended for native applications (e.g. Android, iOS, UWP, Electron, etc.) where you leave the ...
user avatar
  • 676
18 votes
Accepted

Is a backend API server vulnerable to CSRF?

Our application is a pure backend server. Serving JSON APIs to the users. Users will be calling these APIs from their backend in 99.99% of the cases. ... It does not matter what the API is serving or ...
user avatar
17 votes
Accepted

HTTPS POST request header versus request body

If the transport itself is secured (i.e. https) an attacker can not sniff the data. But it might be logged at the server side and the server might later be compromised or some security leak might ...
user avatar
17 votes

Do I need to hash or encrypt API keys before storing them in a database?

Yes, you should absolutely hash your API keys. In effect, they are your passwords and should be treated as such. And note that's hashed - not encrypted. You never need to decrypt the API keys, hence ...
user avatar
  • 64.2k
16 votes

Store Auth-Token in Cookie or Header?

The accepted answer is conflating session based authentication - where a session is maintained in backend database and is stateful with cookies, which are a transport mechanism and so the pros and ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible