Francois Lascelles

Subscribe to Francois Lascelles: eMailAlertsEmail Alerts
Get Francois Lascelles: homepageHomepage mobileMobile rssRSS facebookFacebook twitterTwitter linkedinLinkedIn

Top Stories by Francois Lascelles

In the article "The importance of threat protection for restful web services", I presented a number of content-based threats for XML. When protecting an endpoint from XML based attacks, not only are payloads scanned for code injections, malicious entity declarations and parser attacks, XML documents are actually validated against strict schemas that clearly describe expected document structures. Enforcing this type of compliance at the edge, in a SOA gateway for example, minimizes the risk of attacks of the Web service endpoint. Structure definition languages such as XML Schema Definition (XSD), schematron, XPath are all helpful tools in describing the type of data and structure of XML documents that are expected at runtime. JavaScript Object Notation (JSON) is increasingly being considered as an alternative to XML and already established as the preferred content-typ... (more)

Give me a JWT, I’ll give you an Access Token

One of the common misconceptions about OAuth is that it provides identity federation by itself. Although supporting OAuth with federated identities is a valid pattern and is essential to many API providers, it does require the combination of OAuth with an additional federated authentication mechanism. Note that I’m not talking about leveraging OAuth for federation (that’s OpenID Connect), but rather, an OAuth handshake in which the OAuth Authorization Server (AS) federates the authentication of the user. There are different ways to federate the authentication of an end user as p... (more)

Standardize HMAC, OAuth RESTful Authentication Schemes

As the enterprise is increasingly taking notice of WOA (Web Oriented Architecture) these days, the need for security guidelines and standards for RESTful Web services is becoming more pressing. Sure, RESTful Web services are meant to borrow existing security mechanisms from the web and HTTP Basic over SSL, when done right, is a great way to accomplish shared-secret based authentication. Yet, for better or for worse, it is common to find REST API providers defining their own authentication mechanisms. Take for example the Amazon S3 REST API’s custom HTTP authentication scheme. Us... (more)

The Importance of Threat Protection for RESTful Web Services

SOA Best Practices Digest Although certain RESTful web services are of a ‘public’ nature and do not have specific security requirements such as authentication and authorization, any service that has an entry point from an untrusted network is subject to attack and proper threat protection measures are always an essential consideration. RESTful web services are closely aligned to the web itself and as such inherit all traditional threats from the web. Although network level threats are well understood and addressed by traditional firewall infrastructure, RESTful web services typ... (more)

REST JSON to SOAP Conversion Tutorial

I often get asked about ‘REST to SOAP’ transformation use cases these days. Using an SOA gateway like SecureSpan to perform this type of transformation at runtime is trivial to setup. With SecureSpan in front of any existing web service (in the DMZ for example), you can virtualize a REST version of this same service. Using an example, here is a description of the steps to perform this conversion. Imagine the geoloc web service for recording geographical locations. It has two methods, one for setting a location and one for getting a location. See below what this would look like i... (more)