40 questions
- Bountied 0
- Unanswered
- Frequent
- Score
- Trending
- Week
- Month
- Unanswered (my tags)
Best practices
0
votes
0
replies
22
views
Secure API integration of Gravitee APIM Control with JWT tokens and API integration | Security
I have done SAML with iDP and have followed similar for OAuth2. This integration I am not sure where to start.
I went through these:
APIM Documentation
APIM Plans
GRAVITEE Configure JWT Security ...
-5
votes
1
answer
168
views
API Security and protection from non trusted clients
We are facing an issue with a malicious user who has details about how our website works. Using the developer tools in the browser, the login and subsequent APIs are studied and a mobile app is built ...
1
vote
1
answer
264
views
Blazor Server. How do I connect to my API protected with [Authorize]? Works fine on my laptop but not on Azure
Edit: it's been suggested that I edit this question to differentiate it from previously answered questions. Others have noted that I shouldn't be using HttpContextAccessor.HttpContext in Blazor server ...
1
vote
1
answer
260
views
Troubleshooting Zap Docker Image for Authenticated API Scan
I am trying to conducting an API scan using Zap Docker image, despite passing authentication configurations, authenticated endpoints return 404/403 errors. Unauthenticated endpoints scan correctly. ...
0
votes
1
answer
118
views
API resource security with Asgardeo scope in Ballerina
To secure API resources in Ballerina, according to the doc, I can put scope like
so if in JWT scope is not listed resource can't be invoked
@http:ResourceConfig {
auth: [
{
...
0
votes
1
answer
182
views
Client side securing token vulnerability circular dilemma
I am sorry but this question needs to be long so you can understand the problem and it is absolutely relative the size of my problem, I am seeking web security experts opinion so thank you for your ...
0
votes
1
answer
83
views
Enhance the security of ASP.NET Core Web API unauthorized get endpoint
I have the scenario where there is one web (Admin Panel) and another is front site on another domain. Now I want to provide the facility of "Impersonate" where supper admin can gain the ...
1
vote
0
answers
164
views
How to perform validation before decoding the raw JSON?
We are building an API Framework in PHP (Hacklang) and will be using json-schema from OPIS to implement validation of JSON input in the request body.
OWASP recommends implementing validations on ...
0
votes
1
answer
74
views
Multiple HTTPS security schemes for different endpoints in the same API?
Is it possible to have a API (HTTPS), which has some endpoints (test_1, test_2) with different HTTP methods (test_1-GET,POST) while GET and POST are having different HTTPS security features. (like ...
1
vote
2
answers
789
views
Managing remotely-generated API keys with Ansible
I'm using ansible to provision a particular service, and before I can interact with it I must first generate an API key. But I can't predefine that key in my playbook (as a secret) - it is generated ...
-2
votes
1
answer
161
views
Preventing to send requests from different devices
I have a Spring Boot project with a login endpoint that generates a token for accessing other endpoints. When a user logs in from a specific device (browser or application), I want to add a security ...
0
votes
1
answer
1k
views
Server / X-Powered-By headers not available in runtime
The "Server" and "X-Powered-By" headers are not present in the API response during runtime (or debugging) but appearing only on Postman / browser.
My objective is to remove to ...
0
votes
0
answers
188
views
How to protect my RESR Api calls in Flutter?
I am developing an app in flutter which will have in app purchases. I am keeping track of user credits and some other things on my node server.
I am concerned that if I call my node api to increase ...
0
votes
1
answer
357
views
SubscriptionKeyInvalid in Azure API Management for an endpoint in a product that does not require subscription?
I have a very strange issue with Azure API Management, that I don't seem to figure out...
We have an API operation that is part of an APIM API that is linked with a Product that does not require a ...
0
votes
1
answer
281
views
How to encrypt and decrypt all API trequest and response in SAP hybris?
I have a security requirement that all the data flows through API should be encrypted. I don't see any OOTB implementation. So I have thought about having a filter to decrypt and a custom sanitizer to ...