Security concern regarding web service

Question

I'm currently working on a pet project with two of my buddies. This web service will provide basic functionality such as Login/Password Modification/Registration etc.

All of us are comfortable with jQuery and ASP.NET. My friend's idea is to -

Set up a web service on the same domain and send it data for registration, validation and password retrieval through jQuery ajax.

This same process is going to be used for other CRUD ops as well.

I'm not sure though, isn't this a huge security risk? Couldn't a normal person write some code that could create thousands of dummy users in our application?

Would setting up a secondary web service that handles authorization (OAUTH 2.0 or something like that) and calls the web service that connects directly to the database reduce the security risk?

Answer 1

If you're going to write a login system yourself, it's probably best to stick with traditional methods of registration via confirmation emails or similar. You can't both make registration something that can be automated (web API) and make it hard to automate (spam bots). Delegating to a third party for authentication may be a good option.

Answer 2

Yes, it helps security - possibly not by much, but every little helps in the web world. What you've done is reduce the attack surface for someone who's taken over your web server with a zero-day (or other) attack. If you accessed the database directly in your webserver, the attacker would be able to simply read out all the user's data (or worse - their credit card data) without much trouble. At least now they have to hit each user individually via the API you created for the web service.

So you can take the concept further and build more layers of security into it. Throttle the user creation limit, add additional values that need to be correct in order to access the service.

Nothings perfect, but you can make it much harder for an attacker by not letting them have easy access to all your data. Personally, I'd put all your other business logic code into webservices too.