How to secure REST API from replay attacks with parameter manipulation?

Question

I am developing secure payment APIs, and I want to avoid replay attacks with manipulation of the parameters in the url. For example in the following API call:

https://ap

Answer 1

THE API SERVER

I am developing secure payment APIs, and I want to avoid replay attacks with manipulation of the parameters in the url.

Before we dive into addressing your concerns it's important to first clarify a common misconception among developers, that relates to knowing the difference between who vs what is accessing the API server.

The difference between who and what is accessing the API server.

This is discussed in more detail in this article I wrote, where we can read:

The what is the thing making the request to the API server. Is it really a genuine instance of your mobile app, or is it a bot, an automated script or an attacker manually poking around your API server with a tool like Postman?

The who is the user of the mobile app that we can authenticate, authorize and identify in several ways, like using OpenID Connect or OAUTH2 flows.

If the quoted text is not enough for you to understand the differences, then please go ahead and read the entire section of the article, because without this being well understood you are prone to apply less effective security measures in your API server and clients.

SECURITY LAYERS AND PARAMETERS IN THE URL

For example in the following API call: https://api.payment.com/wallet/transfer?from_account=123&to_account=456&amount=100

Security is all about applying as many layers of defence as possible in order to make the attack as harder and laborious as possible, think of it as the many layers in an onion you need to peel to arrive to the center one.

Attackers will always look for the most easy targets, the lower hanging fruit in the tree, because they don't want to resort to use a ladder when they can take the fruit from another tree with lower hanging fruit ;)

So one of the first layers of defense is to avoid using parameters in the url for sensitive calls, thus I would use a POST request with all the parameters in the body of the request, because this type of request cannot be done by simply copy paste the url into the browser or any other tool, thus they require more effort and knowledge to be performed, aka the fruit is more high in the tree for the attacker.

Another reason is that GET requests end up in the logs of the servers, thus can be accidentally exposed and easily replayed.

REPLAY ATTACKS FOR API CALLS

Once this API call is executed, someone with enough knowledge can execute the same API call by modifying any of the three parameters to his/her own advantage.

Yes they can, and they can learn how your API works even if you don't have public documentation for it, they just need to reveres engineer it with the help of any open source tool for mobile apps and web apps.

I have thought of issuing a temporary token (transaction token) for each transaction. But this also doesn't sounds like enough.

Yes it's not enough because this temporary token can be stolen via a MitM attack, just like a show in the article Steal That Api Key With a Man in the Middle Attack:

So, in this article you will learn how to setup and run a MitM attack to intercept https traffic in a mobile device under your control, so that you can steal the API key. Finally, you will see at a high level how MitM attacks can be mitigated.

So after performing the MitM attack to steal the token it's easy to use curl, Postman or any other similar tool to make the requests to the API server just like if you are the genuine who and what the API server expects.

MITIGATE REPLAY ATTACKS

Improving on Existing Security Defence

I have thought of issuing a temporary token (transaction token) for each transaction. But this also doesn't sounds like enough.

This approach is good but not enough as you alreay noticed, but you can improve it, if not have done it already, by making this temporary token usable only one time.

Another important defence measure is to not allow the requests with same amount and same recipients(from_account, to_account) be repeated in sequence, even if they have a new temporary token.

Also don't allow requests from the same source to be made to fast, specially if they are intended to come from human interactions.

This measures on their own will not totally solve the issue, but add some more layers into the onion.

Using HMAC for the One Time Token

In order to try to help the server to be confident about who and what is making the request you can use a Keyed-Hash Message Authentication Code (HMAC) which is designed to prevent hijacking and tampering, and as per Wikipedia:

In cryptography, an HMAC (sometimes expanded as either keyed-hash message authentication code or hash-based message authentication code) is a specific type of message authentication code (MAC) involving a cryptographic hash function and a secret cryptographic key. As with any MAC, it may be used to simultaneously verify both the data integrity and the authenticity of a message.

So you could have the client creating an HMAC token with the request url, user authentication token, your temporary token, and the time stamp that should be also present in a request header. The server would then grab the same data from the request and perform it's own calculation of the HMAC token, and only proceed with the request if it's own result matches the one for the HMAC token header in the request.

For a practical example of this in action you can read part 1 and part 2 of this blog series about API protection techniques in the context of a mobile app, that also features a web app impersonating the mobile app.

So you can see here how the mobile app calculates the HMAC, and here how the Api server calculates and validates it. But you can also see here how the web app fakes the HMAC token to make the API server think that the requests is indeed from who and what it expects to come from, the mobile app.

Mobile App Code::

/**
    * Compute an API request HMAC using the given request URL and authorization request header value.
    *
    * @param context the application context
    * @param url the request URL
    * @param authHeaderValue the value of the authorization request header
    * @return the request HMAC
    */
   private fun calculateAPIRequestHMAC(url: URL, authHeaderValue: String): String {

       val secret = HMAC_SECRET
       var keySpec: SecretKeySpec

       // Configure the request HMAC based on the demo stage
       when (currentDemoStage) {
           DemoStage.API_KEY_PROTECTION, DemoStage.APPROOV_APP_AUTH_PROTECTION -> {
               throw IllegalStateException("calculateAPIRequestHMAC() not used in this demo stage")
           }
           DemoStage.HMAC_STATIC_SECRET_PROTECTION -> {
               // Just use the static secret to initialise the key spec for this demo stage
               keySpec = SecretKeySpec(Base64.decode(secret, Base64.DEFAULT), "HmacSHA256")
               Log.i(TAG, "CALCULATE STATIC HMAC")
           }
           DemoStage.HMAC_DYNAMIC_SECRET_PROTECTION -> {
               Log.i(TAG, "CALCULATE DYNAMIC HMAC")
               // Obfuscate the static secret to produce a dynamic secret to initialise the key
               // spec for this demo stage
               val obfuscatedSecretData = Base64.decode(secret, Base64.DEFAULT)
               val shipFastAPIKeyData = loadShipFastAPIKey().toByteArray(Charsets.UTF_8)
               for (i in 0 until minOf(obfuscatedSecretData.size, shipFastAPIKeyData.size)) {
                   obfuscatedSecretData[i] = (obfuscatedSecretData[i].toInt() xor shipFastAPIKeyData[i].toInt()).toByte()
               }
               val obfuscatedSecret = Base64.encode(obfuscatedSecretData, Base64.DEFAULT)
               keySpec = SecretKeySpec(Base64.decode(obfuscatedSecret, Base64.DEFAULT), "HmacSHA256")
           }
       }

       Log.i(TAG, "protocol: ${url.protocol}")
       Log.i(TAG, "host: ${url.host}")
       Log.i(TAG, "path: ${url.path}")
       Log.i(TAG, "Authentication: $authHeaderValue")

       // Compute the request HMAC using the HMAC SHA-256 algorithm
       val hmac = Mac.getInstance("HmacSHA256")
       hmac.init(keySpec)
       hmac.update(url.protocol.toByteArray(Charsets.UTF_8))
       hmac.update(url.host.toByteArray(Charsets.UTF_8))
       hmac.update(url.path.toByteArray(Charsets.UTF_8))
       hmac.update(authHeaderValue.toByteArray(Charsets.UTF_8))
       return hmac.doFinal().toHex()
   }

API server code:

if (DEMO.CURRENT_STAGE == DEMO.STAGES.HMAC_STATIC_SECRET_PROTECTION) {
      // Just use the static secret during HMAC verification for this demo stage
      hmac = crypto.createHmac('sha256', base64_decoded_hmac_secret)
      log.info('---> VALIDATING STATIC HMAC <---')

    } else if (DEMO.CURRENT_STAGE == DEMO.STAGES.HMAC_DYNAMIC_SECRET_PROTECTION) {
      log.info('---> VALIDATING DYNAMIC HMAC <---')
      // Obfuscate the static secret to produce a dynamic secret to use during HMAC
      // verification for this demo stage
      let obfuscatedSecretData = base64_decoded_hmac_secret
      let shipFastAPIKeyData = new Buffer(config.SHIPFAST_API_KEY)

      for (let i = 0; i < Math.min(obfuscatedSecretData.length, shipFastAPIKeyData.length); i++) {
        obfuscatedSecretData[i] ^= shipFastAPIKeyData[i]
      }

      let obfuscatedSecret = new Buffer(obfuscatedSecretData).toString('base64')
      hmac = crypto.createHmac('sha256', Buffer.from(obfuscatedSecret, 'base64'))
    }

    let requestProtocol

    if (config.SHIPFAST_SERVER_BEHIND_PROXY) {
      requestProtocol = req.get(config.SHIPFAST_REQUEST_PROXY_PROTOCOL_HEADER)
    } else {
      requestProtocol = req.protocol
    }

    log.info("protocol: " + requestProtocol)
    log.info("host: " + req.hostname)
    log.info("originalUrl: " + req.originalUrl)
    log.info("Authorization: " + req.get('Authorization'))

    // Compute the request HMAC using the HMAC SHA-256 algorithm
    hmac.update(requestProtocol)
    hmac.update(req.hostname)
    hmac.update(req.originalUrl)
    hmac.update(req.get('Authorization'))
    let ourShipFastHMAC = hmac.digest('hex')

    // Check to see if our HMAC matches the one sent in the request header
    // and send an error response if it doesn't
    if (ourShipFastHMAC != requestShipFastHMAC) {
      log.error("\tShipFast HMAC invalid: received " + requestShipFastHMAC
        + " but should be " + ourShipFastHMAC)
      res.status(403).send()
      return
    }

    log.success("\nValid HMAC.")

Web APP code:

function computeHMAC(url, idToken) {
    if (currentDemoStage == DEMO_STAGE.HMAC_STATIC_SECRET_PROTECTION
            || currentDemoStage == DEMO_STAGE.HMAC_DYNAMIC_SECRET_PROTECTION)  {
        var hmacSecret
        if (currentDemoStage == DEMO_STAGE.HMAC_STATIC_SECRET_PROTECTION) {
            // Just use the static secret in the HMAC for this demo stage
            hmacSecret = HMAC_SECRET
        }
        else if (currentDemoStage == DEMO_STAGE.HMAC_DYNAMIC_SECRET_PROTECTION) {
            // Obfuscate the static secret to produce a dynamic secret to
            // use in the HMAC for this demo stage
            var staticSecret = HMAC_SECRET
            var dynamicSecret = CryptoJS.enc.Base64.parse(staticSecret)
            var shipFastAPIKey = CryptoJS.enc.Utf8.parse($("#shipfast-api-key-input").val())
            for (var i = 0; i < Math.min(dynamicSecret.words.length, shipFastAPIKey.words.length); i++) {
                dynamicSecret.words[i] ^= shipFastAPIKey.words[i]
            }
            dynamicSecret = CryptoJS.enc.Base64.stringify(dynamicSecret)
            hmacSecret = dynamicSecret
        }

        if (hmacSecret) {
            var parser = document.createElement('a')
            parser.href = url
            var msg = parser.protocol.substring(0, parser.protocol.length - 1)
                + parser.hostname + parser.pathname + idToken
            var hmac = CryptoJS.HmacSHA256(msg, CryptoJS.enc.Base64.parse(hmacSecret)).toString(CryptoJS.enc.Hex)
            return hmac
        }
    }
    return null
}

NOTE: While the above code is not using the exact same parameters that you would use in your case, it is a good starting pointing for you to understand the basics of it.

As you can see the way the HMAC token is calculated across mobile app, Api server and the Web app are identical in the semantics of the logic, thus resulting in the same HMAC token, and this way the Web app is able to defeat the Api server defense to only accept valid request from the mobile app.

The bottom line here is that anything you place in the client code can be reverse engineered in order to replicate it in another client. So should I use HMAC tokens in my use case? Yes, because it's one more layer in the onion or a fruit more high in the tree.

Can I do better? Yes you can do, just keep reading...

Enhance and Strength the Security

Can anyone suggest the best way to mitigate replay attacks with parameters tampering?

Going with the layered defence approach once more, you should look to other layered approaches that will allow your API server to be more confident about who and waht is accessing it.

So if the clients of you API server are only mobile apps, then please read this answer for the question How to secure an API REST for mobile app?.

In the case you need to secure an API that serves both a mobile and web app, then see this another answer for the question Unauthorized API Calls - Secure and allow only registered Frontend app.

GOING THE EXTRA MILE

Now I would like to recommend you the excellent work of the OWASP foundation:

The Web Security Testing Guide:

The OWASP Web Security Testing Guide includes a "best practice" penetration testing framework which users can implement in their own organizations and a "low level" penetration testing guide that describes techniques for testing most common web application and web service security issues.

The Mobile Security Testing Guide:

The Mobile Security Testing Guide (MSTG) is a comprehensive manual for mobile app security development, testing and reverse engineering.