1

So I have a a website. Now I'm making an App for it. In the app I need to sign the user in. So I'm making an API for it.

The problem is, once I make this API. How will I be able to test for robots and what have you?

example. on my website I have recaptcha from google where you click to verify you're not a robot and then proceed.

Is there a similar method for APIs?

Trevor Wood
  • 533
  • 1
  • 4
  • 11
  • If all methods in your API require an authenticated request, placing a captcha on the login will mitigate the threat of robots. – user2320464 Oct 06 '16 at 17:53
  • @user2320464 I'm just using a post request at the moment. How would you check if the request is authenticated or not? – Trevor Wood Oct 06 '16 at 19:57

2 Answers2

2

You could put the captcha in the app.

  1. App requests captcha
  2. Server provides captcha
  3. App displays captcha and returns user response to server
  4. Server generates token and sends to app, the app can send that token with any requests
Roshan Bhumbra
  • 166
  • 3
0

I assume your API is REST based. Take a look at the OWASP REST API Security cheat sheet for best practices on how to secure your API.

As mentioned in the link

Anti-replay. Attackers will cut and paste a blob and become someone else. Consider using a time limited encryption key, keyed against the session token or API key, date and time, and incoming IP address. In general, implement some protection of local client storage of the authentication token to mitigate replay attacks.

It is better to use an existing tried and tested REST framework which provides all these security features rather than building your own.

ARau
  • 619
  • 4
  • 9