Oauth2 tokens or jwt.
Seems to me the answer is indeed that simple: use OAuth2 and be done.
So you need to get an access token by validating against a third-party (keycloak, auth0) to access your own API? That's a pain.
Ask HN: What's the recommended method of adding authentication to a REST API?
31–40 of 254 posts
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#32If you choose to use JWTs I suggest still keeping a database of tokens and validate against that. This way you have an option to revoke the token and force client to get a new one. This is useful for when token data becomes stale, e.g. email changed, roles added etc. Simply keeping it all in token is not enough.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#33Use Access-control-allow-origin and set it to only allow calls from a specific address.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#34Anyone know amy good resources for the following scenario: WEB API that a device needs to authenticate to. Can't store password on device (it's a device we don't control). No user, so authentication has to be all autommated. i.e. we need to run software on a clients machine, and it has to authenticate to our web api to send us data. We obviously don't want to hard code the credentials in the software as that can be t…
Can't store password on device (it's a device we don't control) Can you expand on this? Because storing a device-specific password (or api key, which is essentially the same) would be my first suggestion. If it's because you can't configure the device, then my suggestion would be to create a process that embeds the device key into the software before deploying to each particular device.
We need to run software on clients machines, we need this software to be running as service (no UI). This service needs to communicate back to use securely via our Web API.
We could have a password entered by our systems guys who deploy to a new machine for the first time, the service encrypts and stores that on disc, then each time it wants to talk to us it can decrypt its password.
I'm not sure if that would be a good solution, or is it just as insecure as having password in the code.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#35Anyone know amy good resources for the following scenario: WEB API that a device needs to authenticate to. Can't store password on device (it's a device we don't control). No user, so authentication has to be all autommated. i.e. we need to run software on a clients machine, and it has to authenticate to our web api to send us data. We obviously don't want to hard code the credentials in the software as that can be t…
1. As secret, use encrypted(some internal device id, pregenerated-key) 2. Generate pregenerated-key upon first login (maybe based on email or tel no?). Just like, e.g., Signal does it 3. On your servers, check if pregenerated-key and/or email is used more than once at the same time, if so invalidate it and direct user to 2.
We already do number 3 :)
We monitor for the same login being used twice at the same time and disconnect both and delete the account.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#36Use Access-control-allow-origin and set it to only allow calls from a specific address.
Can someone fake the origin?
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#37Why not use either simple API key or HTTP basic auth? Both are simple to implement and supported by all the tools and libraries.
I would consider more complicated solutions only if you first come to conclusion that these simple things are not fit for the purpose.
True that some fancy token based solution may reduce database load, but if the API is doing something useful then that one primary key lookup and potentially the password hashing won't be a show stopper. Drawback with tokens and skipping the DB check is that you can't simply kill a client behaving badly. With API key you can just change the key and requests stop immediately (with MVP product this might be an issue, since maybe you have decided to add rate limits etc later).
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#38Earlier quoted context omitted.
Can't store password on device (it's a device we don't control) Can you expand on this? Because storing a device-specific password (or api key, which is essentially the same) would be my first suggestion. If it's because you can't configure the device, then my suggestion would be to create a process that embeds the device key into the software before deploying to each particular device.
We need to run software on clients machines, we need this software to be running as service (no UI). This service needs to communicate back to use securely via our Web API. We could have a password entered by our systems guys who deploy to a new machine for the first time, the service encrypts and stores that on disc, then each time it wants to talk to us it can decrypt its password. I'm not sure if that would be a g…
That sounds a lot like hardware-id based DRM, doesn't it?
Kind of like the (in)famous Denuvo
https://en.wikipedia.org/wiki/Denuvo
Which obviously can be cracked, but it takes a long time.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#39Why not use either simple API key or HTTP basic auth? Both are simple to implement and supported by all the tools and libraries. I would consider more complicated solutions only if you first come to conclusion that these simple things are not fit for the purpose. True that some fancy token based solution may reduce database load, but if the API is doing something useful then that one primary key lookup and potentiall…
HTTP Basic authentication should never be used, it is very vulnerable to traffic analysis attacks. HTTP Digest authentication however, would be a perfectly fine solution.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#40Why not use either simple API key or HTTP basic auth? Both are simple to implement and supported by all the tools and libraries. I would consider more complicated solutions only if you first come to conclusion that these simple things are not fit for the purpose. True that some fancy token based solution may reduce database load, but if the API is doing something useful then that one primary key lookup and potentiall…
I would agree, always start simple - unless you manipulate sensitive data - a shared secret is a good place to start (api-key or basic/digest auth)
You can always introduce other forms of authentication later. I have a slight preference for basic/digest auth as the secret isn't part of the URL, and therefore not cached/logged by any network equipment.