Secure Web api .

Sourabh Dhiman

6y1.1kAJAX

How to secure rest api with ajax call

6 Replies

Know the answer? Post it — somebody with the same question will find it here.

Jaimin Shethiya6y ago
Accepted answer
Hello,

can you please refer below link for protecting our web api

https://fullstackmark.com/post/19/jwt-authentication-flow-with-refresh-tokens-in-aspnet-core-web-api
http://www.decatechlabs.com/secure-webapi-using-jwt
https://jasonwatmore.com/post/2018/08/14/aspnet-core-21-jwt-authentication-tutorial-with-example-api
http://blogs.quovantis.com/json-web-token-jwt-with-web-api/

Thanks
0
Nirmal Dayal6y ago
Hi Sourabh,

You need to use token based authentication in web api.

https://www.dotnettricks.com/learn/webapi/token-based-authentication-in-aspnet-web-api
0
Laxmidhar Sahoo6y ago
YEs
puneet is correct.Different way can secured
1- Encrept and decript of token
2- passport authentication
3-Autherization of the service
0
Dipa Mehta6y ago
You could/should make it harder to use a token. Implementing a max-usage per token, a max life-time, ... It is however impossible to know if it is the scriptkiddie or your 'application' contacting your api.

A lot of people tend to forget that it is never the application calling the api, it's the application, telling the client what api to call. Everything else is based on trust. And on the internet, trust is deprecated.
0
Puneet Kankar6y ago
Hi Sourabh,
We can follow some steps for secure APIs like authentication and authorization, encryption-decryption, input validate, token base auth, Html encoding, cross-origin etc.

Check below links for better guidelines for secure rest API.

https://dzone.com/articles/top-5-rest-api-security-guidelines

https://restfulapi.net/security-essentials/

https://stormpath.com/blog/secure-your-rest-api-right-way

https://dzone.com/refcardz/rest-api-security-1?chapter=12
+3
Dinesh Gabhane6y ago
https://softwareengineering.stackexchange.com/questions/289700/securing-ajax-calls-to-rest-api

https://stackoverflow.com/questions/32777168/secure-ajax-call-on-rest-api
-1