The tag has no usage guidance.

learn more… | top users | synonyms

23
votes
3answers
8k views

REST API security Stored token vs JWT vs OAuth

I am still trying to find the best security solution for protecting REST API, because the amount of mobile applications and API is increasing every day. I have tried different ways of authentication,...
9
votes
7answers
3k views

Will Authentication over HTTPS Slow My Application?

I am building a web application and RESTful web service. I have been reading various articles about the best way to authenticate the requests to the web service. The best option for me seems to be ...
8
votes
5answers
3k views

OAuth2 ROPC vs Basic Auth for public REST APIs?

The specific use case I'm interested in here is authenticating REST clients against publicly-available server endpoints (such as a public REST API). The simplest solution here is Basic Auth. But I ...
7
votes
2answers
2k views

Is HTTPS enough to avoid replay attacks?

I am exposing a few REST methods on a server for an mobile app. I would like to avoid that users can sniff how HTTP methods are built (from the mobile app) and then send them again to the server. ...
3
votes
2answers
273 views

Do logged in users need to browse a site over https?

I've never thought it was necessary, but a client has requested that all webpages served to logged in users be delivered over HTTPS. Aside from the implementation standpoint, which I don't think I'm ...
3
votes
3answers
121 views

Is a predefined key enough security when performing HTTP requests between two secure servers?

I have an AdWords script that regularly transfers sensitive data to my server using a POST HTTP request. For security I have a predefined 32 character randomized string that is verified by my server ...
3
votes
1answer
9k views

Two way Communication between Server and Clients

Situation: We have a web application running on a server. This application needs to fetch data from some other PC(Clients), which are on a different network. On the clients' pc there are WCF hosted ...
2
votes
2answers
314 views

Committing https certificates to Github…is there ever a good reason for this?

If a server certificate is published to Github, a la: -----BEGIN CERTIFICATE----- is that necessarily a bad thing? Is there ever a legitimate reason to do this? I ask because of a recent wave of ...
2
votes
1answer
148 views

Is HTTP 426 acceptable for “Your request should have been HTTPS”

I have an HTTP serving an API which works either anonymously or with a secret key in a header, like so: GET /profile?authenticationKey Authorization: 1234567890 I want to reject any request coming ...
2
votes
1answer
60 views

Does HTTPS prevents man in the middle sending the same message several times [duplicate]

If a User is exchanging messages with a Server over HTTPS, could a man in the middle intercept messages and send them several time. For instance, George orders a laptop on a https e-commerce, could ...
1
vote
1answer
90 views

Random number for HTTPS MAC

Recently I found that Netscape used quite simple algorithm to generate random number for Message Authentication Code to establish an HTTPS connection (Nestscpe used time, process identification number,...
0
votes
2answers
80 views

How ensure secure two cloud services can only talk to each other?

Question Given two cloud services, Sender A & Receiver B, communicating over HTTPS, what options do I have to ensure that Receiver B only response to Sender A? For the purposes of Background ...
0
votes
2answers
113 views

Should my public webservices use HTTP or HTTPS?

The situation is a bit more complex than the title suggests (but not much). I'm working on a REST API that will have a few open / publicly available resources and a few with authentication. (The ...
0
votes
1answer
93 views

ssl requirement -is this just initial handshaking so that subsequent socket communication can commence as normal

I am new to SSL/HTTPS so uncertain on the basics. PROBLEM: A Java applet must communicate with a socket server listening on a port on the web server. Also communication must be secure. Without SSL, ...
0
votes
1answer
66 views

Secure Form Submission

This is probably a no brainer, but I've not been able to find an answer that is definitive. I have a Codeigniter site running on Apache with mod_rewrite (to get rid of index.php) and mod_ssl for ...
-1
votes
2answers
141 views

In C is it possible to change http requests to https [closed]

Long story short I've got this package that currently has a security risk where credentials are sent over http and I need to convert them to https but I currently lack the knowledge to do so. Could ...
-1
votes
0answers
30 views

oauth2, grant types, and mobile apps [closed]

I'm implementing a webservice which utilises oauth2 Specifically using this library: http://bshaffer.github.io/oauth2-server-php-docs/ I have the beginnings of an android app that will access the ...