secure rest API for running user "apps" in an iframe

Posted by Brian Armstrong on Stack Overflow See other posts from Stack Overflow or by Brian Armstrong
Published on 2010-04-04T01:03:39Z Indexed on 2010/04/04 1:13 UTC
Read the original article Hit count: 369

Filed under:

rest

|

secure

|

https

|

ruby-on-rails

I want to let users create "apps" (like Facebook apps) for my website, and I'm trying to figure out the best way to make it secure.

I have a REST api
i want to run the user apps in an iframe on my own site (not a safe markup language like FBML)

I was first looking at oAuth but this seems overkill for my solution. The "apps" don't need to be run on external sites or in desktop apps or anything. The user would stay on my site at all times but see the user submitted "app" through the iframe.

So when I call the app the first time through the iframe, I can pass it some variables so it knows which logged in user is using it on my site. It can then use this user session in it's own API calls to customize the display.

If the call is passed in the clear, I don't want someone to be able to intercept the session and impersonate the user.

Does anyone know a good way to do this or good write up on it? Thanks!

© Stack Overflow or respective owner

Related posts about rest

REST: How to store and reuse REST call queries

as seen on Programmers - Search for 'Programmers'
I'm learning C# by programming a real monstrosity of an application for personal use. Part of my application uses several SPARQL queries like so: const string ArtistByRdfsLabel = @" PREFIX rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#> SELECT… >>> More
REST Framework - MS Web Api vs the rest of the field

as seen on Programmers - Search for 'Programmers'
I am a .NET developer who is looking into the OSS world for a REST framework similar to Microsoft's Web Api. I'll be starting a personal project soon and need to develop both a web site and an API with the API coming first. I've ruled out Ruby on Rails just because I feel that with my background… >>> More
Self Hosted WCF REST Service or Hosting WCF REST Service in Console Application

as seen on C# Corner - Search for 'C# Corner'
n this article, I will show you How to create a REST based service, How to host a REST,based service in Console application and How to consume a REST Service at client. >>> More
Trouble determining proper decoding of a REST response from an ArcGIS REST service using IHttpModule

as seen on Stack Overflow - Search for 'Stack Overflow'
First a little background on what I am trying to achieve. I have an application that is utilizing REST services served by ArcGIS Server and IIS7. The REST services return data in one of several different formats. I am requesting a JSON response. I want to be able to modify the response (remove… >>> More
WCF REST on .Net 4.0

as seen on Geeks with Blogs - Search for 'Geeks with Blogs'
A simple and straight forward article taken from: http://christopherdeweese.com/blog2/post/drop-the-soap-wcf-rest-and-pretty-uris-in-net-4 Drop the Soap: WCF, REST, and Pretty URIs in .NET 4 Years ago I was working in libraries when the Web 2.0 revolution began. One of the things that caught… >>> More

Related posts about secure

Secure Networks Require Secure Web Gateways

as seen on Internet.com - Search for 'Internet.com'
Most IT shops have handled the e-mail threat but overlook the rise of the Web as today's primary attack vector. Secure Web gateways that know better than to trust "good" sites will be key to addressing that oversight. >>> More
All Secure: "Secure Testimony"

as seen on Oracle Technology Network - Search for 'Oracle Technology Network'
Advising the United States Congress about cybersecurity >>> More
Different settings for secure & non-secure versions of Django site using WSGI

as seen on Server Fault - Search for 'Server Fault'
I have a Django website where some of the URLs need to be served over HTTPS and some over a normal connection. It's running on Apache and using WSGI. Here's the config: <VirtualHost example.org:80> ServerName example.org DocumentRoot /var/www/html/mysite WSGIDaemonProcess mysite … >>> More
using paperclip with secure and non-secure files

as seen on Stack Overflow - Search for 'Stack Overflow'
First off, we have this namespaced/sti'd structure for our different types of 'Media' Media< Ar::Base Media::Local < Media Media::Local::Image < Media::Local Media::Local::Csv < Media::Local etc... etc.. This is excellent since a user can have many media, and how we display each piece… >>> More
Secure messaging using Secure MIME is it reliable?

as seen on Stack Overflow - Search for 'Stack Overflow'
We have an automatic reporting and notification system written in .net that sends emails with plain text. We are having to encrypt the messages that we send our clients. The possible implementation approaches we have: Send messages as S/Mime email with attachments. Plain text email with that just… >>> More