Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What's the recommended method of adding authentication to a REST API?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 254 posts

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#41

Post by barrystaes »

Do everything via HTTPS, disable HTTP. The login request (POST, dont use url query params) contains username + password. The API replies with a session token (a random string). You can store any metadata relating to this session token in your DB.

The API client should this token in every request that requires authentication, often in the header as `Authorization : Bearer 123TheToken456`.

JWT: If DB performance becomes a problem (or you want to expose signed session metadata) consider using JWT to provide session validation with the request itself. The downsides of JWT are that its often used to hold secret values (dont do this), or is a few kilobytes big which makes all requests slow, or stupid mistakes in signing and session validation that make it very insecure like allowing any request to just specify false permissions.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#42

Post by brianshaler »

LandR wrote: post #34
icebraining wrote: post #25

Earlier quoted context omitted.

Can't store password on device (it's a device we don't control) Can you expand on this? Because storing a device-specific password (or api key, which is essentially the same) would be my first suggestion. If it's because you can't configure the device, then my suggestion would be to create a process that embeds the device key into the software before deploying to each particular device.

We need to run software on clients machines, we need this software to be running as service (no UI). This service needs to communicate back to use securely via our Web API. We could have a password entered by our systems guys who deploy to a new machine for the first time, the service encrypts and stores that on disc, then each time it wants to talk to us it can decrypt its password. I'm not sure if that would be a g…

> password entered encrypts and stores that on disc, then each time it wants to talk to us it can decrypt its password.

Is there a reason you don't want to use tokens? Upon authenticating once (admin, manually), the web service would generate a token, which it would store and potentially have to revoke.

With something like OAuth, the token could be more temporary and automatically replaced during each use, to avoid having one secret (whether it be a password or token) that could be leaked and used by multiple clients.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#43

Post by dozzie »

comradesmith wrote: post #39
jpalomaki wrote: post #37

Why not use either simple API key or HTTP basic auth? Both are simple to implement and supported by all the tools and libraries. I would consider more complicated solutions only if you first come to conclusion that these simple things are not fit for the purpose. True that some fancy token based solution may reduce database load, but if the API is doing something useful then that one primary key lookup and potentiall…

HTTP Basic authentication should never be used, it is very vulnerable to traffic analysis attacks. HTTP Digest authentication however, would be a perfectly fine solution.

How so? Over SSL? (Note that you should never call anything requiring authentication/authorization over plain HTTP.)

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#44

Post by [deleted] »

comradesmith wrote: post #39
jpalomaki wrote: post #37

Why not use either simple API key or HTTP basic auth? Both are simple to implement and supported by all the tools and libraries. I would consider more complicated solutions only if you first come to conclusion that these simple things are not fit for the purpose. True that some fancy token based solution may reduce database load, but if the API is doing something useful then that one primary key lookup and potentiall…

HTTP Basic authentication should never be used, it is very vulnerable to traffic analysis attacks. HTTP Digest authentication however, would be a perfectly fine solution.

[deleted]

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#45

Post by comradesmith »

dozzie wrote: post #43
comradesmith wrote: post #39

Earlier quoted context omitted.

HTTP Basic authentication should never be used, it is very vulnerable to traffic analysis attacks. HTTP Digest authentication however, would be a perfectly fine solution.

How so? Over SSL? (Note that you should never call anything requiring authentication/authorization over plain HTTP.)

A quick Google suggests you're right, as in either case you must run SSL/TLS.

Appypolylogies.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#46

Post by MaxBarraclough »

sidhuko wrote: post #31
MaxBarraclough wrote: post #28

Earlier quoted context omitted.

Seems to me the answer is indeed that simple: use OAuth2 and be done.

So you need to get an access token by validating against a third-party (keycloak, auth0) to access your own API? That's a pain.

Third-party? Token-issuance is just another endpoint, no?

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#47

Post by mattmanser »

baddox wrote: post #9

I’d say it depends a lot. If your API just serves public non-user-specific data, a simple API key might be okay. The obvious downside of this method is that a user leaking their client API key is a big problem, especially if your users are likely to distribute code that makes requests (e.g. a mobile app that makes requests to your API). The state of the art is probably still OAuth, where clients regularly request ses…

Can you explain why only "public non-user-specific data" is suitable for basic auth over HTTPS?

For most SasS products, basic auth or an API key is going to be fine. In fact, a ton of SasS vendors do exactly that. It's also totally fine for, say, an enterprise API used by a partner or clients.

Oauth is a cluster-fuck of terribleness, a nightmare for you to work with and a nightmare for your consumers to use. If you do it, you will need to have excellent support docs and examples or have to hand-hold external devs to get it working. The only time I might start considering OAuth is if you want other apps to be granted permissions to use the API on behalf of the user, where you want some granularity of which parts they can access.

I'm not saying OAuth doesn't have a use, but it's awful, overcomplicated implementation means it's a huge time-sink compared to basic auth over HTTPS and I certainly wouldn't recommend it without a very good reason.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#48

Post by spdionis »

sidhuko wrote: post #31
MaxBarraclough wrote: post #28

Earlier quoted context omitted.

Seems to me the answer is indeed that simple: use OAuth2 and be done.

So you need to get an access token by validating against a third-party (keycloak, auth0) to access your own API? That's a pain.

Just use a regular oauth server library in your language/framework of choice.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#49

Post by fimdomeio »

barrystaes wrote: post #41

Do everything via HTTPS, disable HTTP. The login request (POST, dont use url query params) contains username + password. The API replies with a session token (a random string). You can store any metadata relating to this session token in your DB. The API client should this token in every request that requires authentication, often in the header as `Authorization : Bearer 123TheToken456`. JWT: If DB performance become…

I basically do this with jwt. In my case jwt just contains the basic data that the front needs to find out who the user is and what it can do (user uuid and role). While obviously checking if action is allowed to user is done server side it's normally useful for the front end to also be aware.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#50

Post by fimdomeio »

ssudaraka wrote: post #36
niwde wrote: post #33

Use Access-control-allow-origin and set it to only allow calls from a specific address.

Can someone fake the origin?

This is controlled on browser level and most (all?) browsers implement this. Origin can be faked by just using anything that can make a http request, like curl. It exists to protect users not the server.
Post reply on HN