New answers tagged rest
0
If the underlying application is malicious, there is not really much that can be done to prevent against anything, let alone CSRF, especially when the page is being loaded inside a webview of the malicious app. As j__m mentioned, it is indeed in complete control of the webview & can choose to do whatever it wishes with it.
I recently wrote a blogpost ...
0
Your scenario is not described completely and is difficult to understand what is the issue, however you can do the next checks:
Your application should use TLS, so all your requests will be encrypted over the internet, is your application using HTTP?
You should review your application, according your explanation this could be a bug in your application. You ...
4
Your request, at least how you describe it, isn't authenticated. This means that anyone at any time can send such a request and trigger a transaction.
I assume that TLS is a given, as you are using HTTPS in your example URL. This is of course a must have.
You need to implement the following mechanisms to protect your API against this problem:
...
2
While theft of the access tokens is a concern for all kinds of tokens, a special concern for stateless ones is that they can be used even after the user has logged out. As the receiving API does not have a source of truth apart from the token itself, it accepts any token that has not expired or otherwise been "globally invalidated" (for instance by revoking ...
Top 50 recent answers are included
