Re: put in safety my Rest Web Services

[Pete Helgren <pete@xxxxxxxxxx>]

Seems to me that you would need some kind of authentication step. Not to 
the IBM i but to your application.  Otherwise anyone could see what the 
URL is that is being passed and use it themselves.  I actually did a 
similar "hack" to get my electricity generation and consumption totals 
from the local utilities web service. I logged in and determined what 
URL/API calls were being made from the browser and then used the same 
calls to get info for my web application (which basically shows my solar 
output and my electricity consumption on my web site).  Basically, if 
you know your account number, you can call their API and get account 
information.  Not very safe since you could use *any* account number and 
then see what the API returned.

I have multiple web apps that I want to protect during the JSON data 
calls to my IBM i.  Those web apps DO require some authentication so my 
idea is to generate a hash using a server side key that validates that 
they are logged in and what they can access. I haven't gone very far 
with it yet so I will be interested in what kind of responses you get.

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java

On 8/17/2015 12:42 PM, p.Caroti wrote:
> Hi
>
>   
>
> I have written and published some web Services to send and receive data from
> App (Android and iOs) ; at this moment  anybody that know System I ip
> address and web service name could send and receive data from my System i.
> My question is how could protect the Web Service's call . I was thinking to
> a dynamic password linked to date and time passed as parameter in uri ..
> Which technique do you use in this situations ?
>
>   
>
> Thanks in advance