Use Access-control-allow-origin and set it to only allow calls from a specific address.
Can someone fake the origin?
from browser ? No. from non-browser clients like curl ? Yes. And your server will never be able to tell if it is fake or not
Ask HN: What's the recommended method of adding authentication to a REST API?
51–60 of 254 posts
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#52One generic solution is to have identity on the server (users table) and generate one or more tokens for each user. When a user wants to make an authenticated API call, they have to add the approprite header to their request:
curl -X GET https://127.0.0.1:8000/api/example/ -H 'Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b'
This is what comes out of the box with Django Rest Framework.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#53AWS has their own v4 signature method that I always thought was neat.
Key benefits:
* Secret not included in request
* Verifies integrity of the message (since its contents are signed)
* Protection against replay attacks
It's probably overkill in a lot of situations, but I've always liked how even if TLS were compromised, all the attacker would gain is the ability to see the requests--not modify them or forge new ones.
I haven't used JWT before, but reading one of the links below, it looks like it covers a lot of the same stuff (although you'd have to implement your own replay protection if you want that).
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#54Depends on what you want. You can just use an API key if it's for easy access, through a header.
If you want more, then use username + pass. Encrypt both or generate something from both of them. Eg. encrypt(username):encrypt(pass)
If you want more, use private & public keys, which receive a session token the first time ( when authenticating).
...
I think the end result would be a self hosted oauth server with permission management.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#55Oauth2 tokens or jwt.
Seems to me the answer is indeed that simple: use OAuth2 and be done.
OAuth 2.0 is so bloated that it scares people off. Something like the client credentials flow is relatively easy to implement on your own and is basically lets clients exchange a client_id (username) and secret (password) for an API key.
Bonus: If you stay close enough to the standard you can plugin a real OAuth 2.0 provider if/when you decide you need it.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#56Do everything via HTTPS, disable HTTP. The login request (POST, dont use url query params) contains username + password. The API replies with a session token (a random string). You can store any metadata relating to this session token in your DB. The API client should this token in every request that requires authentication, often in the header as `Authorization : Bearer 123TheToken456`. JWT: If DB performance become…
Doesn't a session token violate the stateless principle ?
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#57PAST looks good. https://github.com/paragonie/past Basically JWT but without the pitfalls as far as I can see.
Downside is that this is very new and there is only a PHP library.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#58Why not use either simple API key or HTTP basic auth? Both are simple to implement and supported by all the tools and libraries. I would consider more complicated solutions only if you first come to conclusion that these simple things are not fit for the purpose. True that some fancy token based solution may reduce database load, but if the API is doing something useful then that one primary key lookup and potentiall…
> Drawback with tokens and skipping the DB check is that you can't simply kill a client behaving badly.
You can solve this with a token/user blacklist. There are desirable (and undesirable) characteristics of using a blacklist instead of a whitelist, but you don't lose this capability.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#59Do everything via HTTPS, disable HTTP. The login request (POST, dont use url query params) contains username + password. The API replies with a session token (a random string). You can store any metadata relating to this session token in your DB. The API client should this token in every request that requires authentication, often in the header as `Authorization : Bearer 123TheToken456`. JWT: If DB performance become…
Doesn't a session token violate the stateless principle ?
If you use it for authorization only, it doesn’t.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#60It makes me sad that in 2018 that it is entirely reasonable for such a simple and common question to elicit so many answers. Of course no one solution fits all use cases, but skimming the comments there seems to be a very diverse range of suggestions. Wouldn't it be lovely if there was one stand-out solution that was so good it was a no-brainer?
FWIW I have ended up using OAuth2 for this situation a few times, and it always feels more complicated than I'd like.