OAuth(Robust, Many Libraries), JWT(Easy to understand and implement), API Keys/Tokens(Simple and fast)
Ask HN: What's the recommended method of adding authentication to a REST API?
11–20 of 254 posts
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#12OpenId its an extension of OAuth. OpenID provides "Authentication" while OAuth or JWT provides "Authorization." But the real question is what language are you using? If you are using ASP.NET I'd recommend reading this: https://docs.microsoft.com/en-us/aspnet/web-api/overview/sec...
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#13I suggest JSON Web Tokens. Check this out https://jwt.io/introduction/
I would suggest everyone to stay away from jwt unless they're willing to spend the time to learn how it works. I believe the meta is that jwt is solid itself but allows doing things "wrong". Guardrails so to speak are insufficient if not outright lacking. I'd say just go with plain text token for a web app. I don't like the idea of trusting the client because I don't understand how jwt works.
Trusting in what sense? If my token only has the userId as data, what kind of trust is needed?
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#14Anyone know amy good resources for the following scenario:
WEB API that a device needs to authenticate to. Can't store password on device (it's a device we don't control). No user, so authentication has to be all autommated.
i.e. we need to run software on a clients machine, and it has to authenticate to our web api to send us data.
We obviously don't want to hard code the credentials in the software as that can be trivially extracted.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#15Earlier quoted context omitted.
I would suggest everyone to stay away from jwt unless they're willing to spend the time to learn how it works. I believe the meta is that jwt is solid itself but allows doing things "wrong". Guardrails so to speak are insufficient if not outright lacking. I'd say just go with plain text token for a web app. I don't like the idea of trusting the client because I don't understand how jwt works.
Trusting in what sense? If my token only has the userId as data, what kind of trust is needed?
Some libraries don't make it easy (or possible) to check that the algorithm used by the JWT sent by the client is in fact the algorithm you're using and want the client to come back with, see i.e. https://auth0.com/blog/critical-vulnerabilities-in-json-web-...
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#16For users or applications within your own network?
What would you recommend for both?
Within your own network a simple key/secret combination is enough, as the secret can just be stored as an environment variable, for example.
For users you'd need some way for the users to "fetch the secret", which is effectively what logging in is. At that point you should just use JWT or oAuth.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#17PAST looks good.
https://github.com/paragonie/past
Basically JWT but without the pitfalls as far as I can see.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#18Earlier quoted context omitted.
Trusting in what sense? If my token only has the userId as data, what kind of trust is needed?
Some libraries don't make it easy (or possible) to check that the algorithm used by the JWT sent by the client is in fact the algorithm you're using and want the client to come back with, see i.e. https://auth0.com/blog/critical-vulnerabilities-in-json-web-...
I see, but sticking to HS256 should solve this without much headache.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#19I’d say it depends a lot. If your API just serves public non-user-specific data, a simple API key might be okay. The obvious downside of this method is that a user leaking their client API key is a big problem, especially if your users are likely to distribute code that makes requests (e.g. a mobile app that makes requests to your API). The state of the art is probably still OAuth, where clients regularly request ses…
One thing to be aware of with OAuth 2.0 is Refresh Tokens. If the spec is followed, the Refresh Tokens are long-lived and never expire (the spec makes a suggestion that you revoke used tokens, but it's not required), so if they are leaked you are in for a bad time.
There's an RFC that goes into some of the security considerations of OAuth 2.0, that should be required reading if you implement it (even from a pre-built library): https://tools.ietf.org/html/rfc6819
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#20Anyone know amy good resources for the following scenario: WEB API that a device needs to authenticate to. Can't store password on device (it's a device we don't control). No user, so authentication has to be all autommated. i.e. we need to run software on a clients machine, and it has to authenticate to our web api to send us data. We obviously don't want to hard code the credentials in the software as that can be t…
1. As secret, use encrypted(some internal device id, pregenerated-key)
2. Generate pregenerated-key upon first login (maybe based on email or tel no?). Just like, e.g., Signal does it
3. On your servers, check if pregenerated-key and/or email is used more than once at the same time, if so invalidate it and direct user to 2.