Skip to main content
The 2024 Developer Survey results are live! See the results
299 votes
Accepted

Should I use CSRF protection on Rest API endpoints?

I wasn't originally aiming for a self-answer, but after more reading I've come up with what I believe to be a comprehensive answer that also explains why some might still be interested in CSRF ...
Conor Mancone's user avatar
170 votes
Accepted

Is it more secure to program a client-server system in a language other than English?

Technically slightly, yes. But: It would be security by obscurity, which is a bad idea It does not boost confidence in your product It would be very easy to figure out what does what, it would only ...
Peter Harmann's user avatar
83 votes
Accepted

Returning the wrong HTTP response code on purpose?

Has anyone ever thought about doing this? Yes, there was actually a talk about exactly this at defcon 21 (video, slides). Their conclusion was that working with response codes as offensive security ...
tim's user avatar
  • 29.7k
61 votes

Is it more secure to program a client-server system in a language other than English?

It would not be appreciably more secure. Reverse engineers are often forced to work with systems that do not have any original names intact (production software often strips symbol names), so they get ...
forest's user avatar
  • 67k
60 votes

Returning the wrong HTTP response code on purpose?

It won't actually slow down an attacker any appreciable amount, but will cause any future developers who work on your platform to be really annoyed at you. It may also cause certain nice features of ...
Xiong Chiamiov's user avatar
51 votes
Accepted

Protect API from being tampered?

What if the attacker decides to tamper the "from:id" such that it could send arbitrary messages to anyone from any user? Create a session, and use the session identifier as identifier, not the user ...
vidarlo's user avatar
  • 16.7k
42 votes

Is there a way to prevent someone from making his own client app for my webservice?

This would be impossible. It is fundamental for your app to contain all the instructions necessary to use your API. Anyone with enough skill and time will be able to extract these secrets and create ...
Justin Gerhardt's user avatar
35 votes

Is it more secure to program a client-server system in a language other than English?

Not really - all of the built-in functions will still be in English, so it wouldn't take much extra effort to work out what your variables are going to represent. It might slow someone down slightly, ...
Matthew's user avatar
  • 27.4k
32 votes

Is splitting a REST API server from a Web server considered a security threat?

It would be more accurate to say that "using two servers e.g. api.myservice.org and www.myservice.org has security implications " --in other words, would normally be blocked by default ...
MarkHu's user avatar
  • 421
31 votes
Accepted

What kind of hashing to use for storing REST API tokens in the database?

TLDR; SHA256 is good enough To answer this we need to look at why we salt, hash, and use multiple iterations of the hash, in the first place; Why do we salt? To protect users that have weak password ...
Hybrid's user avatar
  • 4,228
31 votes

What is PKCE actually protecting?

The reason PKCE is important is that on mobile OS, the OS allows apps to register to handle redirect URIs so a malicious app can register and receive redirects with the authorization code for ...
Grokify's user avatar
  • 599
28 votes
Accepted

Spoofing POST/GET requests in a RESTful service

My question is what prevents users from intercepting their regular post form the app (getting the token) and then possibly sending bunch of POST requests (using something like postman or fiddler) to ...
Hector's user avatar
  • 11k
26 votes
Accepted

Generating one time URLs which can be revoked

Looks like you have a pretty good idea what you're doing. The one-time link pattern is pretty common for things like email verification. Typically, you'd store the expiration date in a database and/...
nbering's user avatar
  • 4,028
26 votes
Accepted

Why should someone block all methods other than GET and POST in a RESTful application?

I suspect this is a case of someone zealously applying "best practices" that they don't understand. HTTP Verb Tampering Attack The reason this best practice exists is because of the HTTP ...
Mike Ounsworth's user avatar
25 votes
Accepted

How do you pen test a REST API?

REST Security and API Security are excellent topics of research. This question and the answers provide good starting points to find great tools and techniques to test these interfaces -- API Security ...
atdre's user avatar
  • 19.1k
25 votes

Is there a way to prevent someone from making his own client app for my webservice?

It’s pretty easy and straightforward to create one’s own client regardless of whether REST or SOAP is used, as long as your Existing Client is available for everyone in the Play Store. Just capture ...
JOW's user avatar
  • 2,337
24 votes
Accepted

Store Auth-Token in Cookie or Header?

Cookie Based Authentication Pros HttpOnly Flag: Session cookies can be created with the HttpOnly flag which secures the cookies from malicious JavaScript (XSS-Cross-Site Scripting). Secure flag: ...
Shiv Sahni's user avatar
23 votes
Accepted

What is PKCE actually protecting?

This write-up Okta has on this subject explains this pretty well IMHO. I believe it's because PKCE is intended for native applications (e.g. Android, iOS, UWP, Electron, etc.) where you leave the ...
someone1's user avatar
  • 766
23 votes

Do I need to hash or encrypt API keys before storing them in a database?

Yes, you should absolutely hash your API keys. In effect, they are your passwords and should be treated as such. And note that's hashed - not encrypted. You never need to decrypt the API keys, hence ...
Anders's user avatar
  • 65.7k
23 votes
Accepted

Is splitting a REST API server from a Web server considered a security threat?

From the information provided, it is definitely not a security risk. As long as proper controls are set on the API endpoint (HTTPS, HSTS, etc.), you should be good to go. One thing to note here is ...
Sachin S Kamath's user avatar
21 votes

Store Auth-Token in Cookie or Header?

The accepted answer is conflating session based authentication - where a session is maintained in backend database and is stateful with cookies, which are a transport mechanism and so the pros and ...
Melbourne2991's user avatar
21 votes

Is it more secure to program a client-server system in a language other than English?

That is security through obscurity and will delay a dedicated attacker all of five minutes. If you want to confuse an attacker, naming things their opposite or something unrelated would have the same ...
Tom's user avatar
  • 10.6k
19 votes
Accepted

Do I need additional encryption on top of HTTPS for a REST API?

The communication between the Frontend and Backend is completely unencrypted, resulting in the credentials of a user logging in send over the intranet/internet completely clear text. ...the ...
Anders's user avatar
  • 65.7k
17 votes

Is there a way to prevent someone from making his own client app for my webservice?

From a security perspective, no, there's no way to do this. No matter how much obfuscation you put on the code and protocols, the fact is that the code to access the API and the network traffic ...
micheal65536's user avatar
  • 1,766
15 votes

Should I use CSRF protection on Rest API endpoints?

Whether or not CSRF protection is needed is based on 2 factors: - Is the request doing a state changing action (not the same as REST API Statelessness) - State changing actions are any action that ...
an0904's user avatar
  • 313
13 votes

Should I use CSRF protection on Rest API endpoints?

"there is no way for a browser to automatically provide authentication credentials even if it is somehow tricked into visiting the API endpoint" Just be careful on private networks using ...
stuartm9999's user avatar
13 votes
Accepted

Should we encrypt all REST API calls from a mobile device?

Considering that TLS is in place with a solid configuration (i.e. certificate pinning), which I find no reason not to, you'd need to work out the business risk you're trying to mitigate by encrypting ...
Pedro's user avatar
  • 3,931
13 votes

Protect API from being tampered?

Basically, you have to treat every input from the user as potentially malicious. Vidarlo has already mentioned two security issues and how they can be prevented in his answer. I'd also add that the ...
Lukas's user avatar
  • 3,178
12 votes

Spoofing POST/GET requests in a RESTful service

My question is what prevents users from intercepting their regular post form the app Nothing. Does the fact that the traffic to the service will eventually go via TLS make this a non-issue? If ...
Ruben_NL's user avatar
  • 119
12 votes

Protect API from being tampered?

What if the attacker decides to tamper the "from:id" such that it could send arbitrary messages to anyone from any user? Do not use from:id in your API. You already know it from user authenticated ...
Oleg V. Volkov's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible