288
votes
Accepted
Should I use CSRF protection on Rest API endpoints?
I wasn't originally aiming for a self-answer, but after more reading I've come up with what I believe to be a comprehensive answer that also explains why some might still be interested in CSRF ...
- 30.9k
172
votes
Accepted
Is it more secure to program a client-server system in a language other than English?
Technically slightly, yes. But:
It would be security by obscurity, which is a bad idea
It does not boost confidence in your product
It would be very easy to figure out what does what, it would only ...
- 7,858
83
votes
Accepted
Returning the wrong HTTP response code on purpose?
Has anyone ever thought about doing this?
Yes, there was actually a talk about exactly this at defcon 21 (video, slides).
Their conclusion was that working with response codes as offensive security ...
- 29.5k
61
votes
Is it more secure to program a client-server system in a language other than English?
It would not be appreciably more secure. Reverse engineers are often forced to work with systems that do not have any original names intact (production software often strips symbol names), so they get ...
- 66.5k
60
votes
Returning the wrong HTTP response code on purpose?
It won't actually slow down an attacker any appreciable amount, but will cause any future developers who work on your platform to be really annoyed at you. It may also cause certain nice features of ...
- 9,422
51
votes
Accepted
Protect API from being tampered?
What if the attacker decides to tamper the "from:id" such that it could send arbitrary messages to anyone from any user?
Create a session, and use the session identifier as identifier, not the user ...
- 15.4k
43
votes
Is there a way to prevent someone from making his own client app for my webservice?
This would be impossible. It is fundamental for your app to contain all the instructions necessary to use your API. Anyone with enough skill and time will be able to extract these secrets and create ...
- 381
35
votes
Is it more secure to program a client-server system in a language other than English?
Not really - all of the built-in functions will still be in English, so it wouldn't take much extra effort to work out what your variables are going to represent. It might slow someone down slightly, ...
- 27.4k
33
votes
Accepted
Can I prevent a replay attack of my signed JWTs?
The jti claim as described here is an optional mechanism for preventing further replay attacks. From the spec:
4.1.7. "jti" (JWT ID) Claim
The "jti" (JWT ID) claim provides a ...
- 465
32
votes
Is splitting a REST API server from a Web server considered a security threat?
It would be more accurate to say that "using two servers e.g. api.myservice.org and www.myservice.org has security implications " --in other words, would normally be blocked by default ...
- 421
30
votes
What is PKCE actually protecting?
The reason PKCE is important is that on mobile OS, the OS allows apps to register to handle redirect URIs so a malicious app can register and receive redirects with the authorization code for ...
- 579
29
votes
Accepted
What kind of hashing to use for storing REST API tokens in the database?
TLDR; SHA256 is good enough
To answer this we need to look at why we salt, hash, and use multiple iterations of the hash, in the first place;
Why do we salt? To protect users that have weak password ...
- 4,198
28
votes
Accepted
Spoofing POST/GET requests in a RESTful service
My question is what prevents users from intercepting their regular post form the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to ...
- 10.9k
27
votes
Accepted
Why should someone block all methods other than GET and POST in a RESTful application?
I suspect this is a case of someone zealously applying "best practices" that they don't understand.
HTTP Verb Tampering Attack
The reason this best practice exists is because of the HTTP ...
- 58.8k
26
votes
Accepted
Generating one time URLs which can be revoked
Looks like you have a pretty good idea what you're doing.
The one-time link pattern is pretty common for things like email verification. Typically, you'd store the expiration date in a database and/...
- 4,028
25
votes
Accepted
How do you pen test a REST API?
REST Security and API Security are excellent topics of research.
This question and the answers provide good starting points to find great tools and techniques to test these interfaces -- API Security ...
- 19k
25
votes
Is there a way to prevent someone from making his own client app for my webservice?
It’s pretty easy and straightforward to create one’s own client regardless of whether REST or SOAP is used, as long as your Existing Client is available for everyone in the Play Store. Just capture ...
- 2,357
24
votes
Accepted
Store Auth-Token in Cookie or Header?
Cookie Based Authentication
Pros
HttpOnly Flag: Session cookies can be created with the HttpOnly flag which secures the cookies from malicious JavaScript (XSS-Cross-Site Scripting).
Secure flag: ...
- 965
23
votes
Accepted
Is splitting a REST API server from a Web server considered a security threat?
From the information provided, it is definitely not a security risk. As long as proper controls are set on the API endpoint (HTTPS, HSTS, etc.), you should be good to go.
One thing to note here is ...
- 488
21
votes
Accepted
What is PKCE actually protecting?
This write-up Okta has on this subject explains this pretty well IMHO.
I believe it's because PKCE is intended for native applications (e.g. Android, iOS, UWP, Electron, etc.) where you leave the ...
- 746
21
votes
Do I need to hash or encrypt API keys before storing them in a database?
Yes, you should absolutely hash your API keys. In effect, they are your passwords and should be treated as such. And note that's hashed - not encrypted. You never need to decrypt the API keys, hence ...
- 65.4k
21
votes
Is it more secure to program a client-server system in a language other than English?
That is security through obscurity and will delay a dedicated attacker all of five minutes.
If you want to confuse an attacker, naming things their opposite or something unrelated would have the same ...
- 10.2k
20
votes
Store Auth-Token in Cookie or Header?
The accepted answer is conflating session based authentication - where a session is maintained in backend database and is stateful with cookies, which are a transport mechanism and so the pros and ...
- 301
19
votes
Accepted
Do I need additional encryption on top of HTTPS for a REST API?
The communication between the Frontend and Backend is completely unencrypted, resulting in the credentials of a user logging in send over the intranet/internet completely clear text.
...the ...
- 65.4k
17
votes
Is there a way to prevent someone from making his own client app for my webservice?
From a security perspective, no, there's no way to do this. No matter how much obfuscation you put on the code and protocols, the fact is that the code to access the API and the network traffic ...
- 1,766
13
votes
Should I use CSRF protection on Rest API endpoints?
Whether or not CSRF protection is needed is based on 2 factors: -
Is the request doing a state changing action (not the same as REST API Statelessness) - State changing actions are any action that ...
- 193
13
votes
Accepted
Should we encrypt all REST API calls from a mobile device?
Considering that TLS is in place with a solid configuration (i.e. certificate pinning), which I find no reason not to, you'd need to work out the business risk you're trying to mitigate by encrypting ...
- 3,931
13
votes
Protect API from being tampered?
Basically, you have to treat every input from the user as potentially malicious.
Vidarlo has already mentioned two security issues and how they can be prevented in his answer.
I'd also add that the ...
- 3,188
12
votes
Where should I store OAuth2 access tokens?
If the request to the 3rd party API is through your server, then store the access token in the database tied to the user, encrypted with a key that is stored as an environment variable. If the ...
- 1,758
12
votes
Should I use CSRF protection on Rest API endpoints?
"there is no way for a browser to automatically provide authentication
credentials even if it is somehow tricked into visiting the API
endpoint"
Just be careful on private networks using ...
- 121
Only top scored, non community-wiki answers of a minimum length are eligible