Collaborate Disseminate
I see that there are some APIs which exchange some sort public keys to secure the content of https connection using asymmetric encryption. Is there any added benefit to this? As far as I know, it should be impossible to man i… Continue reading Certificate Pinning vs E2E Encryption
I have a ReactJs web app, an Android app that both consuming a REST API built with django, the whole project is for media/news, the biggest part of the REST API is public content, there is a little part where user has secured… Continue reading How to Secure REST API from being crawled when serving public content ?
I build a web application and get data via REST API.
eg: https://mywebapi.com/product/{productId}
then I get json response and use the json data response in my web page https://myweb.com/product/{productId}
It is pretty obvi… Continue reading How website hide api response?
I am making an API that uses the following steps for encryption. All of this is implemented using libsodium.
When the client requests a public key from the server, the server generates a new public, private key pair and a n… Continue reading Is this REST API encryption scheme secure?
Do we need API security assessment even though it’s covered in the Dynamic Security assessment of web applications using tools like IBM AppScan?
Do we need API security assessment even though it’s covered in the Dynamic Security assessment of web applications using tools like IBM AppScan?
I’m trying to wrap my head around, why it is advised to validate the content-type, sent by a client to a REST API.
OWASP states in their REST Security Cheat Sheet:
When POSTing or PUTting new data, the client will specif… Continue reading Content-type validation in REST APIs
This question already has an answer here:
Ensure web service only accessed by authorized applications
5 answers
I am busy with a pentest and found something that made me wonder if it would be exploitable. I am currently not able to exploit it, but I wanted to make sure. Also I am curious why the application/server behaves as it does.
… Continue reading URL injection vulnerability
I am looking for the database-free way how to validate a secret code that was sent to user’s mobile phone by RESTful web app, in a 2-factor authentication process.
At step 1, the user provides login name and password that is… Continue reading What hashing/encrypting to use for publicly shared string matching a secret code