143
votes
Accepted
Why can't I just let customers connect directly to my database?
TL,DR: Don't.
(My-)SQL permissions are pretty fine-grained, so I'd wager there shouldn't be any obvious security issues
Even with permission on the record level, it does not scale easy. If a user ...
- 53.6k
98
votes
Accepted
How do hackers trick frontend validation?
I think you are very confused about what both CORS and SOP do... neither is relevant to these attacks at all.
There are lots of ways to bypass client-side validation. HTTP is just a stream of bytes, ...
- 46.4k
88
votes
Accepted
Is exposing the server time a security risk?
The server time is of little use to an attacker, generally, as long as it is accurate. In fact, what is being revealed is not the current time (after all, barring relativistic physics, time is ...
- 66.5k
88
votes
Accepted
Preventing users from tampering with input
TL,DR: It's impossible to do so client side.
Client side validation is just a client convenience, not useful to really validate anything. You don't want the client to mistype his email, putting an ...
- 53.6k
83
votes
Accepted
Returning the wrong HTTP response code on purpose?
Has anyone ever thought about doing this?
Yes, there was actually a talk about exactly this at defcon 21 (video, slides).
Their conclusion was that working with response codes as offensive security ...
- 29.5k
69
votes
Why can't I just let customers connect directly to my database?
Interesting question. In theory, this can be done securely. MS-SQL can secure the connection with encryption, authenticate the user, and provides fine-grained permissions and other security features ...
- 33.4k
60
votes
Returning the wrong HTTP response code on purpose?
It won't actually slow down an attacker any appreciable amount, but will cause any future developers who work on your platform to be really annoyed at you. It may also cause certain nice features of ...
- 9,432
58
votes
Why can't I just let customers connect directly to my database?
I've built both RESTful interfaces and provided customers with direct SQL access.
The problem here is that the question is fundamentally flawed:
Lots of the work backend developers do is providing ...
- 680
51
votes
Accepted
Protect API from being tampered?
What if the attacker decides to tamper the "from:id" such that it could send arbitrary messages to anyone from any user?
Create a session, and use the session identifier as identifier, not the user ...
- 15.4k
50
votes
Accepted
Security Headers for a web API
Checking headers off a list is not the best technique to assert a site's security. Services like securityheaders.io can point you in the right direction but all they do is compare against a list of ...
- 44.7k
41
votes
Accepted
Securing API keys for a Twitter account for a program to be run on other PC's
As specified, the problem is completely impossible. You can not, and should not attempt to, make a program - much less a script - do something its user can't see. There are many ways the attacker ...
- 46.4k
37
votes
Why can't I just let customers connect directly to my database?
Performance
You say that performance should be "way better", except that now you've just given malicious actors complete authority to wreck the performance of your DB. Of course, they have to ...
- 471
30
votes
What is PKCE actually protecting?
The reason PKCE is important is that on mobile OS, the OS allows apps to register to handle redirect URIs so a malicious app can register and receive redirects with the authorization code for ...
- 579
29
votes
Accepted
What kind of hashing to use for storing REST API tokens in the database?
TLDR; SHA256 is good enough
To answer this we need to look at why we salt, hash, and use multiple iterations of the hash, in the first place;
Why do we salt? To protect users that have weak password ...
- 4,198
28
votes
Accepted
How does a refresh token help?
The main advantage of a refresh token is that it is easier to detect if it is compromised.
Consider these two scenarios:
A single long-lasting auth token is used.
A short duration auth token is used,...
- 9,192
28
votes
Accepted
Spoofing POST/GET requests in a RESTful service
My question is what prevents users from intercepting their regular post form the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to ...
- 10.9k
27
votes
Accepted
Public API with authorization token -- is it possible to protect the demo token?
As Steffen has said you cannot protect the token from users.
I'd just like to add a suggestion for a more general scenario of having a "demo" Api. It sounds like your API doesn't have any stored ...
- 2,064
25
votes
Accepted
How do you pen test a REST API?
REST Security and API Security are excellent topics of research.
This question and the answers provide good starting points to find great tools and techniques to test these interfaces -- API Security ...
- 19k
25
votes
Preventing users from tampering with input
You'll have to validate it on the server side. You say that the number of possible permutations is too large - but the client side somehow did it, didn't it? If the server side doesn't have enough ...
- 1,030
24
votes
Accepted
Store Auth-Token in Cookie or Header?
Cookie Based Authentication
Pros
HttpOnly Flag: Session cookies can be created with the HttpOnly flag which secures the cookies from malicious JavaScript (XSS-Cross-Site Scripting).
Secure flag: ...
- 965
23
votes
How do hackers trick frontend validation?
Maybe a very short answer will help as well.
I never thought about it much, I just thought this meant someone could
bypass the validations by making a request on something like Postman.
But then I ...
- 329
22
votes
Accepted
What is PKCE actually protecting?
This write-up Okta has on this subject explains this pretty well IMHO.
I believe it's because PKCE is intended for native applications (e.g. Android, iOS, UWP, Electron, etc.) where you leave the ...
- 756
21
votes
Do I need to hash or encrypt API keys before storing them in a database?
Yes, you should absolutely hash your API keys. In effect, they are your passwords and should be treated as such. And note that's hashed - not encrypted. You never need to decrypt the API keys, hence ...
- 65.4k
21
votes
Accepted
Is it possible to ensure client data is correct?
To put it simply: There is NO way
As you already determined, a request can easily be forged.
Even if using a custom encryption, your users can decompile your code and find out how it's done.
The ...
- 1,144
20
votes
Store Auth-Token in Cookie or Header?
The accepted answer is conflating session based authentication - where a session is maintained in backend database and is stateful with cookies, which are a transport mechanism and so the pros and ...
- 301
19
votes
Why can't I just let customers connect directly to my database?
This could be a reasonable approach in certain circumstances:
The customer gets read-only access.
They get read access to an entire database: it's either quasi-public data to all your customers, or ...
- 303
18
votes
Accepted
How does including a magic prefix to a JSON response work to prevent XSSI attacks?
XSSI works by trying to evaluate a JSON response as Javascript and the sequence )]}' prevents this by reliably producing a syntax error.
There have been different proposed countermeasures against ...
- 44.7k
18
votes
OIDC Flow for SPA and RESTful API
Here is the difference between Implicit Flow and AuthCode Flow:
Implicit Flow
NOTE: As of April 2019, the Oauth Working Group no longer recommends the use of Implicit Flow for most cases because there ...
- 1,360
18
votes
Accepted
Is a backend API server vulnerable to CSRF?
Our application is a pure backend server. Serving JSON APIs to the users.
Users will be calling these APIs from their backend in 99.99% of the cases. ...
It does not matter what the API is serving or ...
- 198k
16
votes
Accepted
What is the difference between API keys and API tokens usages?
API keys are public, by intent. They are an authorisation mechanism, not an authentication mechanism (this is mentioned in your links). It does not matter how they are generated but it matters how ...
- 128k
Only top scored, non community-wiki answers of a minimum length are eligible