Collaborate Disseminate
Background
I am working on an IoT project where we are using ATMega Micro Controllers as end devices. These devices need to communicate with REST services and post some sensitive data. The REST services are implemented usin… Continue reading Arduino/ATMega calling HTTPS REST services
Background
I am implementing set of Micro services using Java spring MVC and hosted in Undertow containers using Gradle. I am using a Java keystore to secure my keys which are using by the service to perform encryption and s… Continue reading Securely store password for Java Keystore
I am using a set of microservices (Spring MVC Hosted in Undertow containers along with Gradle) which are spawned on different ports in the same machine. Services make HTTP REST to each other.
I need a tool to monitor HTTP t… Continue reading Tool to listen http traffic goes to different ports (Windows)
This is a potentially hypothetical question since it has not been determined whether we will be required to do this but I figure it’s a question that will come up more often.
Background
When implementing RESTful services th… Continue reading Hiding sensitive data in URIs
I have a REST API backend which has HTTPS (and blocked HTTP) and use JWT as the authentication mechanism. The client side is iOS/Android app. I want to add a layer of safeguard on critical API by using client nonce to prevent (mostly) res… Continue reading Preventing resubmission and replay attack using client nonce in REST API
I have a REST API backend which has HTTPS (and blocked HTTP) and use JWT as the authentication mechanism. Client side is iOS/Android App. I want to add a layer of safeguard on critical API by using client nonce to prevent (m… Continue reading Preventing resubmission and replay attack using client nonce in REST API
So the thing is I have created a Asp.Net web api and am using oauth to secure the access.
The problem is that the clients want to make a pure html(angular) website from which they will access the api. So basically they will c… Continue reading How to securely access web api from Html5 Website
When you look at Amazons RESTAuthentication you can see that it doesn’t use a nonce:
Authorization = “AWS” + ” ” + AWSAccessKeyId + “:” + Signature;
Signature = Base64( HMAC-SHA1( YourSecretAccessKeyID, UTF-8-Encoding-Of( S… Continue reading Why isn’t Amazon using a NONCE for REST Authentication?
I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved).
As part of the login flow we have been instructed to use an email/password reg… Continue reading REST API security mobile application with PIN
I am looking into writing an API that will be accessed by mobile devices (We also own the mobile application, there are no 3rd parties involved).
As part of the login flow we have been instructed to use an email/password reg… Continue reading REST API security mobile application with PIN