Re: put in safety my Rest Web Services

Seems to me that you would need some kind of authentication step. Not to the IBM i but to your application. Otherwise anyone could see what the URL is that is being passed and use it themselves. I actually did a similar "hack" to get my electricity generation and consumption totals from the local utilities web service. I logged in and determined what URL/API calls were being made from the browser and then used the same calls to get info for my web application (which basically shows my solar output and my electricity consumption on my web site). Basically, if you know your account number, you can call their API and get account information. Not very safe since you could use *any* account number and then see what the API returned.

I have multiple web apps that I want to protect during the JSON data calls to my IBM i. Those web apps DO require some authentication so my idea is to generate a hash using a server side key that validates that they are logged in and what they can access. I haven't gone very far with it yet so I will be interested in what kind of responses you get.

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java

On 8/17/2015 12:42 PM, p.Caroti wrote:

Hi


I have written and published some web Services to send and receive data from
App (Android and iOs) ; at this moment anybody that know System I ip
address and web service name could send and receive data from my System i.
My question is how could protect the Web Service's call . I was thinking to
a dynamic password linked to date and time passed as parameter in uri ..
Which technique do you use in this situations ?


Thanks in advance