Showing posts with label php. Show all posts
Showing posts with label php. Show all posts

Tuesday 20 May 2014

Difference between WebService and API

Difference between WebService and API


S.No
Web Service
API
1
Interaction between two machines over a network. Interaction between two API.
2
Uses SOAP, REST, and XML-RPC as a means of communication. It may use any way to communication
3
Web Services involves calling of system. We can render form in one line, one by one element, element OR  decorator OR error separately.
4
Web service might not contain a complete set of specifications and sometimes might not be able to perform all the tasks that may be possible from a complete API. An API consists of a complete set of rules and specifications for a software program to follow in order to facilitate interaction.
5
All Web services are APIs All APIs are not Web services
6
A Web service always needs a network for its operation API doesn't need a network for its operation
7
WebServices are services available over internet. You can call these services and get so information in your application without know how it works. For example weather webservices gives you information about the city weather. API is a collection of class which provide you some functionality like Google api gives google-search.



Thursday 4 October 2012

Session Hijacking in PHP

Session Hijacking

Session Hijacking is term where attackers hold of a session identifier and is able to send requests as if they were that user.
In particular, it is used to refer to the theft of a magic cookie used to authenticate a user to a remote server.
It has particular relevance to web developers, as the HTTP cookies used to maintain a session on many web sites can be easily stolen by an attacker using an intermediary computer or with access to the saved cookies on the victim's computer (see HTTP cookie theft).


How to prevent your data from Session Hijacking
1) In php.ini set session.hash_function = sha256 or session.hash_function = sha512.
2) In php.ini set  session.hash_bits_per_character = 5
3) Add "user agent" (browser) in session  & check each subsequent request.
4) Add IP Address in session  & check each subsequent request.
5) Change the name of the session from the default PHPSESSID
6) In secure pages ask for reenter the password.