How to secure RESTful web services?

by

There’s another, very secure method. It’s client certificates. Know how servers present an SSL Cert when you contact them on https? Well servers can request a cert from a client so they know the client is who they say they are. Clients generate certs and give them to you over a secure channel (like coming into your office with a USB key – preferably a non-trojaned USB key).

You load the public key of the cert client certificates (and their signer’s certificate(s), if necessary) into your web server, and the web server won’t accept connections from anyone except the people who have the corresponding private keys for the certs it knows about. It runs on the HTTPS layer, so you may even be able to completely skip application-level authentication like OAuth (depending on your requirements). You can abstract a layer away and create a local Certificate Authority and sign Cert Requests from clients, allowing you to skip the ‘make them come into the office’ and ‘load certs onto the server’ steps.

Pain the neck? Absolutely. Good for everything? Nope. Very secure? Yup.

It does rely on clients keeping their certificates safe however (they can’t post their private keys online), and it’s usually used when you sell a service to clients rather then letting anyone register and connect.

Anyway, it may not be the solution you’re looking for (it probably isn’t to be honest), but it’s another option.

More Related Contents:

  1. Secure Web Services: REST over HTTPS vs SOAP + WS-Security. Which is better? [closed]
  2. REST API error return good practices [closed]
  3. Understanding REST: Verbs, error codes, and authentication
  4. How do I upload a file with metadata using a REST web service?
  5. How does Google Maps secure their API Key? How to make something similar?
  6. Patterns for handling batch operations in REST web services?
  7. Why would one use REST instead of SOAP based services? [closed]
  8. How can I verify a Google authentication API access token?
  9. A message body writer for Java type, class myPackage.B, and MIME media type, application/octet-stream, was not found
  10. WSDL vs REST Pros and Cons
  11. What are REST API error handling best practices? [closed]
  12. Rest vs. Soap. Has REST a better performance?
  13. REST API 404: Bad URI, or Missing Resource?
  14. Why do we need RESTful Web Services?
  15. REST web service WSDL? [duplicate]
  16. Calling REST web services from a classic asp page
  17. Non-CRUD operations in a RESTful service
  18. Jersey client exception: A message body writer was not found
  19. Restful API service
  20. Is There a JSON Parser for VB6 / VBA?
  21. Security of REST authentication schemes
  22. Making a WCF Web Service work with GET requests
  23. How to consume a web service from VB6?
  24. How to consume REST in Java [duplicate]
  25. How to keep the OAuth consumer secret safe, and how to react when it’s compromised?
  26. What’s the appropriate HTTP status code to return if a user tries logging in with an incorrect username / password, but correct format?
  27. When is it appropriate to respond with a HTTP 412 error?
  28. encoding of query string parameters in IE10
  29. Generate WSDL for existing SOAP Service using captured traffic
  30. How can I get a Kerberos ticket with Delphi?

Leave a Comment