New answers tagged

0

I was thinking to check the user in the database on each request so I can invalidate the account instantly. Are there any problems with this flow? I don't see anything glaringly wrong, but.... There are some downsides. Doing this, requires that every user-interaction lookup your database table. For a small-ish application with not many users, this ...


1

Here's the list of best practices in securing RESTful API. Always Use HTTPS - Traffic must be encrypted Never expose information on URLs - as this can be captured in web server logs, which makes them easily exploitable. https://api.domain.com/user-management/users/{id}/someAction?apiKey=abcd123456789 Consider Oauth Adding Timestamp in Request - This will ...


Top 50 recent answers are included