REST API Security Jamie Wallace EBSCO LearningExpress Physics 25 - PowerPoint PPT Presentation

Mar 15, 2023 •331 likes •908 views

REST API Security Jamie Wallace EBSCO LearningExpress Physics 25 Years in Software Director of Software Development What is REST? Security? Solutions Implementation What is REST? Security? Solutions Implementation What is REST?

REST API Security Jamie Wallace EBSCO LearningExpress
Physics 25 Years in Software Director of Software Development
What is REST? Security? Solutions Implementation
What is REST? Security? Solutions Implementation
What is REST? Security? Solutions Implementation
What is REST? Security? Solutions Implementation
REST
RE presentational S tate T ransfer
CRUD HTTP verbs using
most web services only use an API key
Request Request Request Validator API Key
Request Validator API Key
Validator API Request Key
Validator API Request
Client Server Side Side
Authorized client Valid and unmodified request No replay attacks All users
Authorized client Valid and unmodified request No replay attacks All users
Authorized client Valid and unmodified request No replay attacks All users
Authorized client Valid and unmodified request No replay attacks All users
Domain Cookie Solution Time based One Time Password JSON Web Token
SessionID Header Validator API Request SessionID Cookie
SessionID Header Request Validator API SessionID Cookie
SessionID Header Validator API Request SessionID Cookie
Validator API Request
Single Multiple Domain Domain
SessionID Header Validator API Request SessionID Cookie
Domain Cookie Solution Time based One Time Password JSON Web Token
Time Periods HMAC Key
Time Periods HMAC Key TOTP
HMAC Key Ç TOTP
Request Validator API TOTP
Request Validator API TOTP
Validator API Request TOTP
Validator API Request
Domain Cookie Solution Time based One Time Password JSON Web Token
Header Payload HMAC Key
Signature Payload Header Signature HMAC Key
Signature Payload Header HMAC Key
Request Validator API JWT
Request Validator API JWT
Validator API Request JWT
Validator API Request
Application Fingerprint
JWT with Signature Service
TS TS Key String 10 115ABC 20 115DEF 30 115GHI HMAC
TS TS Key 10 115ABC 20 115DEF 30 String 115GHI HMAC
TS TS Key 10 115ABC 20 115DEF 30 String 115GHI HMAC Hash
Encrypting JWT with Encryption Service
TS TS Key String 10 115ABC 20 115DEF 30 115GHI HMAC
TS TS Key 10 115ABC 20 115DEF 30 String 115GHI HMAC
TS TS Key 10 115ABC 20 115DEF 30 Encrypted String 115GHI HMAC or Decrypted String
Client Manager Validator Encryption Service Signature Service Key Store
Client Manager Validator Encryption Service Signature Service Key Store
Client Manager Validator Encryption Service Signature Service Key Store
Client Manager Validator Encryption Service Signature Service Key Store
Client Manager Validator Encryption Service Signature Service Key Store
Q & A

Recommend

Outline What is ReST ? Constraints in ReST REST Architecture Components Features of

Outline What is ReST ? Constraints in ReST REST Architecture Components Features of ReST applications Example of requests in REST & SOAP Complex REST request REST Server response Real REST examples REST Design

603 views • 34 slides

RESTful Web Services Stefan Marr Agenda What is REST? The Bookmark Example Principles of REST

RESTful Web Services Stefan Marr Agenda What is REST? The Bookmark Example Principles of REST Web Service Design Semantic of HTTP/1.1 Operations SOAP vs. REST Style Assets and Drawbacks Security Public Web Services HPI, Seminar Advanced

330 views • 10 slides

REST API What it means to be RESTful What is REST REST stands for REpresentational State

REST API What it means to be RESTful What is REST REST stands for REpresentational State Transfer It is neither a standard nor a protocol REST is not HTTP , although because of HTTPs prevalence and popularity the two tend to go

708 views • 11 slides

Introduction to REST Web REST Web Services Characteristics Services Principle of REST Web

Introduction to REST Web Services 2/14/2009 Agenda What is REST? Introduction to REST Web REST Web Services Characteristics Services Principle of REST Web Services Design Semantic of HTTP/1.1 Operations Asst. Prof. Dr. Kanda

522 views • 12 slides

SSC REST API Jonathan Couch Fortify Security Support Engineer How to create a project version

SSC REST API Jonathan Couch Fortify Security Support Engineer How to create a project version Creating a project is not one REST API endpoint call but uses two separate calls using the following endpoints /projectVersions /bulk To

370 views • 17 slides

Preparing a REST API Rules of REST APIs, API patterns, Typical CRUD operations Rules for a REST

Preparing a REST API Rules of REST APIs, API patterns, Typical CRUD operations Rules for a REST API Recall : REST Representational State Transfer o REST is statelessit has no idea of any current user state or history o API

535 views • 17 slides

Rest for the Restless (or Finding Rest in a Family Tree) Matthew 1:1-17 3 Promises of Rest for

Overview [not in slides] Rest for the Restless (or Finding Rest in a Family Tree) Matthew 1:1-17 3 Promises of Rest for the Restless 1. God promises rest in his righteousness 2. God promises rest in his presence 3. God promises rest in his

92 views • 5 slides

presentation kit leave the rest to us SM leave the rest to us SM centrally located leave the

presentation kit leave the rest to us SM leave the rest to us SM centrally located leave the rest to us SM easy access to any places leave the rest to us SM exterior leave the rest to us SM lobby leave the rest to us SM lobby lounge

521 views • 18 slides

Security Evaluation on Amazon Web Services REST API Authentication Protocol Signature Version

Security Evaluation on Amazon Web Services REST API Authentication Protocol Signature Version 4 Khanh Hoang Huynh Jason Kerssens Supervisors: Alex Stavroulakis (KPMG) Aristide Bouix (KPMG) Introduction AWS As of 2018, AWS has a

636 views • 26 slides

Developers Nicole Schmidt and Rob Kraft Agenda Lucity REST API introduction Lucity REST

Lucity for Application Developers Nicole Schmidt and Rob Kraft Agenda Lucity REST API introduction Lucity REST API Recent Changes REST Client Applications Explained Web Hooks Other Options Future Plans Lucity REST API

498 views • 22 slides

Topics RPC vs. REST: What's the What makes an API truly REST best practices difference

Topics RPC vs. REST: What's the What makes an API truly REST best practices difference and why does it RESTful? (Constraints and (common problems and matter? interface) their solutions) Planning and developing Drupal services

632 views • 28 slides

Writing REST APIs with OpenAPI and Swagger Ada Stphane Carrez FOSDEM 2018 OpenAPI and Swagger

Writing REST APIs with OpenAPI and Swagger Ada Stphane Carrez FOSDEM 2018 OpenAPI and Swagger Ada Introduction to OpenAPI and Swagger Writing a REST Ada client Writing a REST Ada server Handling security with OAuth2 Demo

970 views • 37 slides

Security and Privacy 12A. Operating Systems Security Operating Systems Principles 12B.

5/18/2016 Security and Privacy 12A. Operating Systems Security Operating Systems Principles 12B. Authentication 12C. Authorization Security and Privacy 12D. Trust 12E. At-Rest Encryption Mark Kampe (markk@cs.ucla.edu) Security and Privacy

116 views • 8 slides

Copyleft for the Rest of Us Linuxwochen Linz 2016 About me DevOps Engineer Security

Copyleft for the Rest of Us Linuxwochen Linz 2016 About me DevOps Engineer Security Engineer FLOSS Enthusiast FSFE Group Linz coordinator since 2013 FSFE Austrian team (only recently) 28.04.2016 Linuxwochen Wien Outline

728 views • 37 slides

REST Web-based APIs REST Representational State Transfer Style of web software

REST Web-based APIs REST Representational State Transfer Style of web software architecture that simplifies application Not a standard, but a design pattern REST Take all resources for web application (data, files, functions)

722 views • 22 slides

Continuations continued: the REST of the computation Anton van Straaten appsolutions.com 1

Continuations continued: the REST of the computation Anton van Straaten appsolutions.com 1 REST - The 10-second overview "the name given to the architecture of the World Wide Web by Roy Fielding." -- rest-discuss Following REST

789 views • 59 slides

1 We look at the world once, in childhood. The rest is memory. Louise Glck What is

Sharing Developmental Security Helping children heal so they are ready to learn Anne R. Gearity, PhD LICSW 4/17/17 geari002@umn.edu WAY TO GROW 1 We look at the world once, in childhood. The rest is memory. Louise Glck What is

543 views • 23 slides

SECURE BY DESIGN Security Design Principles for the Rest of Us GOTO London 2016 Eoin Woods -

SECURE BY DESIGN Security Design Principles for the Rest of Us GOTO London 2016 Eoin Woods - Endava @eoinwoodz 1 BACKGROUND Eoin Woods CTO at Endava (technology services, 3300 people) 10 years in product development - Bull,

453 views • 31 slides

Mariana Raykova Data Security: Encryption and Digital Signatures Beyond security of data at

Mariana Raykova Data Security: Encryption and Digital Signatures Beyond security of data at rest and communication channels Security of Computation on Sensitive Inputs Secure multiparty computation (MPC) Differential privacy methods

595 views • 43 slides

FROM 00s TO 20s: FROM REST ful to gRPC Gianfranco Reppucci @giefferre Data Engineer WHAT

FROM 00s TO 20s: FROM REST ful to gRPC Gianfranco Reppucci @giefferre Data Engineer WHAT THIS TALK IS ABOUT BEFORE REST S O A P Common Object Request Simple Object Broker Architecture Access Protocol REST: REpresentational State

792 views • 44 slides

More on Distributed Web Services: REST Architecture REST, or Representational State Transfer, is

Web Services REresentation State Transfer (REST) More on Distributed Web Services: REST Architecture REST, or Representational State Transfer, is a distributed communication architecture fast becoming the lingua franca for Cloud Computing. The

353 views • 17 slides

Mariana Raykova Yale, Google Data Security: Encryption and Digital Signatures Beyond security

Mariana Raykova Yale, Google Data Security: Encryption and Digital Signatures Beyond security of data at rest and communication channels Security of Computation on Sensitive Inputs Secure multiparty computation (MPC) Differential

848 views • 26 slides

REST: SOA without Contracts? Stefan Tilkov | innoQ | stefan.tilkov@innoq.com What is REST?

REST: SOA without Contracts? Stefan Tilkov | innoQ | stefan.tilkov@innoq.com What is REST? REST: An Architectural Style One of a number of architectural styles ... described by Roy Fielding in his dissertation ... defined via a set of

563 views • 34 slides

Building a Killer REST Client for Your REST+JSON API Les

Building a Killer REST Client for Your REST+JSON API Les Hazlewood @lhazlewood Apache Shiro Project Chair CTO, Stormpath stormpath.com @lhazlewood |

701 views • 59 slides