Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What's the recommended method of adding authentication to a REST API?

news.ycombinator.com

Post reply on HN
Print view View original

241–250 of 254 posts

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#241

Post by iEchoic »

eropple wrote: post #105
DanHulton wrote: post #87

Earlier quoted context omitted.

The same way you share any of your other data across servers. Save it in a DB or Redis instance that all your servers can reach.

At which point you're hitting it on every request and since it'll be a nice, fast, indexed database lookup you might as well just use session tokens instead of a back-assward blacklist. Do the simplest thing that will work.

As I mentioned, blacklists have different characteristics, some of which are desirable. A blacklist of tokens is (for the vast majority of use cases) orders of magnitude smaller than a whitelist, which means they can often be replicated into memory for in-memory lookups on the webserver.

This is a complex distributed systems topic, and there are applications for both.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#242

Post by eropple »

iEchoic wrote: post #241
eropple wrote: post #105

Earlier quoted context omitted.

At which point you're hitting it on every request and since it'll be a nice, fast, indexed database lookup you might as well just use session tokens instead of a back-assward blacklist. Do the simplest thing that will work.

As I mentioned, blacklists have different characteristics, some of which are desirable. A blacklist of tokens is (for the vast majority of use cases) orders of magnitude smaller than a whitelist, which means they can often be replicated into memory for in-memory lookups on the webserver. This is a complex distributed systems topic, and there are applications for both.

There are cases where a blacklist totally makes sense, I will agree with you on that.

"I can access this thing" are totally not that for the 99.9% case. Do the simplest thing that will work--and the simplest thing so very rarely involves public-key cryptography!

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#243

Post by pw »

tptacek wrote: post #193
adambkaplan wrote: post #187

Earlier quoted context omitted.

Key quote here is > Do the simplest thing that will work: For many a long, a randomized bearer token will do. Depending on the type of data you expose via the API (example - financial data, PII) this may not be sufficient for your security team or auditors.

I run security teams for startups with my current firm, Latacora, which is me and 5 other veterans of security firms. Our clients engage with financial services and with regulated environments (like HIPAA/HITECH and the standards and practices of large health networks). Before that, I founded a company called Matasano, which for almost 10 years was one of the largest software security firms in North America. Unlike a…

Why won't you work with the military? (genuinely asking)

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#244

Post by e12e »

tptacek wrote: post #235
e12e wrote: post #214

Earlier quoted context omitted.

You can rotate the secret to invalidate all tokens.

No, you can't. That breaks all of your users, and so you'll rarely do it, even when it might be warranted. Don't engineer security countermeasures that you (a) might need to rely on and (b) will be afraid to use.

Good points. But for some types of apps, you might have groups of users (a company, team, municipality) that you might be able to afford the cost of "everyone log in again". Or you might be able to safely log out everyone after business hours (if in the same timezone).

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#245

Post by jmulho »

tboyd47 wrote: post #204
jmulho wrote: post #158

Earlier quoted context omitted.

Is there any reason to favor bearer tokens over cookies?

If you use a cookie for an API, it will look like you don't know what you are doing. Also, there are extra rules around Cookies (expiration, length, etc.) that may bite you if you use them outside a browser context.

Ah, so there are other contexts (e.g. native mobile apps) that may be sharing the API, not just browser (web) apps. I think I get it. Thanks.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#246

Post by riquito »

yebyen wrote: post #156
riquito wrote: post #148

Earlier quoted context omitted.

It's necessary because otherwise the encrypted credentials could be copied and used to access the service.

It's not a given that something like Diffie-Helman shared secret is going to put the actual secret on the wire during authentication, or that smart auth strategies similar to this one that don't directly transmit secrets are always going to be susceptible to replay attacks. (I am a dog on the internet, so don't listen to me. I also heard that the best way to get a really good answer is not just to ask any old questio…

That's interesting, do you have an example or an article about how it would not be subsceptible to replay attacks?

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#247

Post by stu_b »

dboreham wrote: post #129
tptacek wrote: post #116

This question comes up all the time on HN. I'm one of a bunch of people on HN that do this kind of work professionally. Here's a recent comment on a recent story about it: https://news.ycombinator.com/item?id=16006394 The short answer is: don't overthink it. Do the simplest thing that will work: use 16+ byte random keys read from /dev/urandom and stored in a database. The cool-kid name for this is "bearer tokens". Yo…

One very important thing you didn't mention : you MUST force transport encryption (SSL/TLS) to be used (deny plaintext connections). This is because the bearer token can be stolen by eavesdropping and since it's a bearer token it can be re-used by anyone anywhere. Also remember to time out the tokens: it is almost never a good idea to permit infinitely long login sessions (surprising how often I see this not done). A…

RE: Denying plaintext connections. Totally agree & great if your clients connect directly to hosting you have full control over. The biggest problem I've come across is that cloud services like CloudFlare & API gateways (Tyk for example) don't have the option (or at least I couldn't find it) to disable HTTP traffic. Plenty offer to redirect HTTP to HTTPS but I haven't been able to refuse HTTP traffic outright.

Does anyone have any recommendations for services that do offer this? (or where those options are in the named services)

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#248

Post by dsacco »

pw wrote: post #243
tptacek wrote: post #193

Earlier quoted context omitted.

I run security teams for startups with my current firm, Latacora, which is me and 5 other veterans of security firms. Our clients engage with financial services and with regulated environments (like HIPAA/HITECH and the standards and practices of large health networks). Before that, I founded a company called Matasano, which for almost 10 years was one of the largest software security firms in North America. Unlike a…

Why won't you work with the military? (genuinely asking)

In case tptacek doesn’t respond, I’d like to give a (hopefully helpful) answer in the aggregate sense: many members of the information security industry refuse to work with the public sector (read: military and intelligence agencies) for reasons of personal ethics. They typically dislike the privacy-antagonistic ends to which they consider their skills, software or inventions would be used. This is particularly the case with many cryptographers, who could walk onto jobs or lucrative contracts with the NSA, but who would never even consider it.

I haven’t spoken to tptacek about this directly, so I want to make it clear I can’t elucidate his specific concerns. But the broad strokes of his principles are very common in the industry, and typically stem from a disagreement in how the government approaches security (philosophically speaking).

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#249

Post by hirstys »

stu_b wrote: post #247
dboreham wrote: post #129

Earlier quoted context omitted.

One very important thing you didn't mention : you MUST force transport encryption (SSL/TLS) to be used (deny plaintext connections). This is because the bearer token can be stolen by eavesdropping and since it's a bearer token it can be re-used by anyone anywhere. Also remember to time out the tokens: it is almost never a good idea to permit infinitely long login sessions (surprising how often I see this not done). A…

RE: Denying plaintext connections. Totally agree & great if your clients connect directly to hosting you have full control over. The biggest problem I've come across is that cloud services like CloudFlare & API gateways (Tyk for example) don't have the option (or at least I couldn't find it) to disable HTTP traffic. Plenty offer to redirect HTTP to HTTPS but I haven't been able to refuse HTTP traffic outright. Does a…

If you can install an open source Tyk gateway in your stack, you can use TLS on the Tyk Gateway to refuse HTTP outright. However, this isn't a Tyk cloud feature at present.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#250

Post by jively »

hirstys wrote: post #249
stu_b wrote: post #247

Earlier quoted context omitted.

RE: Denying plaintext connections. Totally agree & great if your clients connect directly to hosting you have full control over. The biggest problem I've come across is that cloud services like CloudFlare & API gateways (Tyk for example) don't have the option (or at least I couldn't find it) to disable HTTP traffic. Plenty offer to redirect HTTP to HTTPS but I haven't been able to refuse HTTP traffic outright. Does a…

If you can install an open source Tyk gateway in your stack, you can use TLS on the Tyk Gateway to refuse HTTP outright. However, this isn't a Tyk cloud feature at present.

Correction: if Tyk Cloud has a custom domain (CNAME) setup for you then it can ignore https - it’s not a self-service option though.
Post reply on HN