New answers tagged

1

It drastically limits replay attacks, in the unlikely event that an attacker gets ahold of the request. For example, suppose a legit user sends the following request: DELETE /basically/innocuous/trivia HTTP/1.1 Authorization: blahblahblah ... An attacker gets access to this message somehow (maybe they control a TLS-terminating load balancer or something), ...


1

My congratulations. You seem to be a very informed developer in terms of security and that is always good to see :) The Difference Between WHO and WHAT is Accessing the API Server Now I would like to get a understanding how to mitigate the risk, that someone like me can have access to these used API keys. First I would like to clarify a usual misconception ...


0

The fact that you can run a schema query is a first red flag, especially if this is a production environment endpoint. Being able to run schema queries gives an attacker everything they need to explore the API, and if there are any API methods/queries/mutations that can be misused then the schema query will make it easier for them to find any potential ...


-6

Oauth2 was made for delegating access. Twitter has extensive support and good documentation. Never share your API keys directly! https://developer.twitter.com/en/docs/authentication/overview This 15 min video could be helpful if you are unfamiliar with Oauth2 https://youtu.be/t18YB3xDfXI


10

Obviously, I need a way to encrypt they keys so they're not accessible to the user running the program Obviously, this is impossible. Keys are just data. Software is just data. Everything is just data, and if the data is in someone else’s computer, you cannot prevent them from accessing the data! (It is just like writing something on a piece of paper and ...


41

As specified, the problem is completely impossible. You can not, and should not attempt to, make a program - much less a script - do something its user can't see. There are many ways the attacker could break this. They could just read and analyze your python scripts (even if compiled, .pyc is easy to decompile). They could debug the program as it runs. They ...


Top 50 recent answers are included