January 18, 2010
In The importance of threat protection for restful web services, I presented a number of content-based threats for XML. When protecting an endpoint from XML based attacks, not only are payloads scanned for code injections, malicious entity declarations and parser attacks, XML documents are actually validated against strict schemas that clearly describe expected document structures. Enforcing this type of compliance at the edge, in a SOA gateway for example, minimizes the risk of attacks of the Web service endpoint. Structure definition languages such as XML Schema Definition (XSD), schematron, XPath are all helpful tools in describing the type of data and structure of XML documents that are expected at runtime.
A number of recent posts illustrated the use of the SecureSpan SOA Gateway for the protection of RESTful Web services. In How to secure REST and JSON, Scott illustrated how to virtualize a REST API service, how to authenticate and authorize requesters, provide confidentiality, validate incoming query parameters, block code injections, and more. In addition to this, consider the SecureSpan JSON Schema validation assertion which can be incorporated in SecureSpan policies. In the service policy illustrated below, PUT requests are inspected for proper JSON structure using this assertion.
This assertion’s properties allow the administrator to provide a JSON Schema for runtime validation. See below a simple JSON Schema loaded in the assertion’s properties.
For testing this policy, we can PUT requests to this service using the Firefox REST Client plugin. This lets us verify that only JSON stuctures that comply with the JSON Schema are accepted.
Test 1 – Sending a JSON payload that conforms to the JSON Schema.
Test 2 – Sending a JSON payload that violates the JSON Schema prescribed structure.
The ability to validate incoming JSON payloads at the perimeter, in an isolated and secured environment is another example of SecureSpan’s value in securing RESTful environments.
January 6, 2010
Although certain RESTful web services are of a ‘public’ nature and do not have specific security requirements such as authentication and authorization, any service that has an entry point from an untrusted network is subject to attack and proper threat protection measures are always an essential consideration.
RESTful web services are closely aligned to the web itself and as such inherit all traditional threats from the web. Although network level threats are well understood and addressed by traditional firewall infrastructure, RESTful web services type APIs are also subject to content (or message) level threats.
For example, consider APIs where XML payloads are POSTed and/or PUT from external requesters. A particularly dangerous threat was uncovered last summer involving a vulnerability in most XML parsing libraries used at the time. Any REST web service using those XML parsing libraries could have easily been crippled. In fact, I would expect many deployments out there still using vulnerable versions of those XML parsers today.
Despite fixes applied to parsing libraries to address such vulnerabilities, many potential content-level attacks continue to pose a threat. Consider for example external entity attacks, where a parser is tricked into resolving a resource from a malicious source. Also, SQL injections which were recently at the center of the largest data breach in US history . Many other threats specifically targeting XML enabled services exist such as recursive payloads, schema poisoning and coercive parsing to name a few.
Of course, REST is not bound to XML only. Threat protection for RESTful web services has to potentially consider a number of other content-type specific threats such as for JSON.
January 4, 2010
As the enterprise is increasingly taking notice of WOA (Web Oriented Architecture) these days, the need for security guidelines and standards for RESTful Web services is becoming more pressing. Sure, RESTful Web services are meant to borrow existing security mechanisms from the web and HTTP Basic over SSL, when done right, is a great way to accomplish shared-secret based authentication. Yet, for better or for worse, it is common to find REST API providers defining their own authentication mechanisms.
Take for example the Amazon S3 REST API’s custom HTTP authentication scheme. Using this mechanism, a requester signs the RESTful request using HMAC and a symmetric key associated with its Amazon account – the shared secret. This signature is attached to the request through the standard HTTP Authorization header. This achieves requester authentication as well as integrity without SSL. The S3 REST API describes the name of the scheme (‘AWS’) as well as precise ordering for the contents covered by the signature which includes the HTTP VERB, URI, payload, etc. Another example is the Microsoft Windows Azure REST API, which defines a very similar mechanism. However, Windows Azure defines different authentication scheme names (multiple flavors) and the contents and ordering of the “string to sign” is also different. Amazon’s and Azure’s mechanisms are very similar. Unfortunately, their differences make them incompatible.
Must RESTful Web service developers support a different authentication mechanism for each provider they wish to connect with? Clearly a standardized mechanism would be useful.
Perhaps to this effect you often hear OAuth being promoted as a standard security mechanism for RESTful Web service APIs. OAuth defines standardized HMAC and RSA based signatures that are carried in the standard HTTP Authorization header. Although OAuth focuses on a specific use case involving a resource owner authorizing a third party to access said resource from a provider, so called two-legged OAuth enables authentication between a requester and a resource provider. One of the issues with this pattern is that the signature (HMAC or RSA) does not cover payloads for POSTing or PUTting typical RESTFul content-types such as xml or json. The OAuth specification stipulates that only payloads of content-type application/x-www-form-urlencoded are covered. All other content-types signed through OAuth are effectively subject to integrity attacks.
A draft specification from Google, the OAuth Request Body Hash specification attempts to address this OAuth shortcoming by describing an extension of the OAuth specification that enables any payloads to be covered by OAuth signatures regardless of their content-type. Is this the correct solution though? After all, the reason for OAuth to not cover integrity for these payloads in the first place is that OAuth does not focus on a generic RESTful service authentication use case in the first place.
Instead of extending OAuth to make it useful beyond its intended purpose, why not standardize HMAC authentication schemes as used by such REST API providers as Amazon S3 and Windows Azure? Such a standard specification would needs to describe clearly the scheme name and the contents of the signature.