How we overcame the security flaws of performing REST API calls in JavaScript

Re:How we overcame the security flaws of performing REST API... by tptacek on Monday March 17, 2014 @09:21PM (#7419361)

Um, eek?

You can't safely use SHA256 in that construction. The hash is simply the value of the SHA256 internal state after the last block. An attacker can take that hash and resume "hashing" from that point, adding additional data to the original data.

That attack is called "length extension", and it's the reason we have the HMAC construction. Here, I think you want the HMAC-SHA256 of the filter and user ID, with the API key as the HMAC key.

[ Parent | on HN ]

Re:How we overcame the security flaws of performing REST API... by redox_ on Monday March 17, 2014 @09:46PM (#7419467)

Thanks for the feedback guys, gonna edit the blog post and update our code. Having security gurus reading us is definitely a strength of HN!

[ Parent | on HN ]

Re:How we overcame the security flaws of performing REST API... by pointernil on Tuesday March 18, 2014 @04:29AM (#7420769)

Almost funny: not recognizing the need to apply "simple" HMAC but yea we found a secure way to XYZ... eeeek indeed ;)

Time again and again and again: never ever implement your own crypto...

[ Parent | on HN ]