0
votes
1answer
65 views

Securing web services [duplicate]

How to approach securing webservices? I can think of using one of the two approaches below sending a user name password in every request for validation Sending a time based token (GUID or some ...
2
votes
2answers
129 views

Security concern regarding web service

I'm currently working on a pet project with two of my buddies. This web service will provide basic functionality such as Login/Password Modification/Registration etc. All of us are comfortable with ...
0
votes
1answer
102 views

How to provide data to a web server using a data warehouse?

We have data stored in a data warehouse as follows: Price Date Product Name (varchar(25)) We currently only have seven products. Once every business day, seven new data points are added ...
3
votes
1answer
134 views

Some hint to program a webservice “by subscription”

I have some web sites programmed, I know to do it with python and PHP basically. Normally they are simple web sites, but now I want to provide REST web services but only for allowed users (allowed by ...
1
vote
0answers
135 views

How to securely store user credentials from external website

I'm developing an application where I'd like to use credentials from external websites. This will be used to login with the website API and get information for the user. Example: I want to use the ...
4
votes
1answer
406 views

Is a PHP file secure enough on a GoDaddy Server to hard code an AES salt into the file?

So I am creating a web api for an app I am making. The data is sanitized before it is sent to my web api and then encrypted before it is stored in my MySql server. The phone app sanitizes then ...
6
votes
1answer
5k views

What are the best practices to secure a web API?

I need to build a web service API for our mobile app to interact with our server & database (in ASP.Net MVC 4, but that's hardly relevant). Wile most actions do not need users to be registered ...
8
votes
2answers
556 views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
7
votes
4answers
2k views

Best practices for execution of untrusted code

I have a project where I need to allow users to run arbitrary, untrusted python code (a bit like this) against my server. I'm fairly new to python and I'd like to avoid making any mistakes that ...
2
votes
2answers
246 views

Drop in service for account management, authentication, identity?

I'm building an Android app and associated set of web services for uploading/downloading data. I need a basic (no frills) solution for account management (register, login, logout, verify ...
0
votes
1answer
113 views

Strategy for securing paid Data as a Service API

When creating a webservice/api that is intended to be used by javascript/flash/mobile clients, what is a good method for making sure that a paying client's credentials are not stolen and reused. To ...
27
votes
3answers
2k views

Should MVC/REST return a 403 or 404 for resources belonging to other users?

When working with a resource-based site (such as an MVC application or REST service), we have two main options when a client tries to GET a resource that they don't have access to: 403, which says ...
2
votes
3answers
394 views

Security for data produced by ASP.NET web serivce

I'm developing an ASP.NET 2.0 web service that serves XML data from a database. Almost all data traffic is one-way, from server to client, and there is no user-specific data. All clients will ...
2
votes
2answers
624 views

Sending username and password in every request from iPhone app

I'm writing a mobile app & web service combo that requires user to login. The web service will be using SSL, so are there any reasons against sending the user name and password in every web ...
8
votes
1answer
3k views

Software architecture for authentication/access-control of REST web service

I am setting up a new RESTful web service and I need to provide a role-based access control model. I need to create an architecture that will allow users to provide their username and password to get ...
0
votes
2answers
67 views

Marking services for secure handling; Annotation or inheritance?

We have a lot of services, some that demand some security, some that don't. We want an easy way of telling, in code, if a service will be secure or not. What would be the better way: Annotation or ...