Ask HN: What's the recommended method of adding authentication to a REST API? • Hacker News Board

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#61

Post by j_s » Tue, Jan 16, 2018, 2:10 PM UTC

scandox wrote: post #17

PAST looks good. https://github.com/paragonie/past Basically JWT but without the pitfalls as far as I can see.

Definitely depends on timeline; PAST is a reasonable recommendation gaining momentum as best practice. The recent Show HN annoucement discussed many caveats of authentication tokens:

Show HN: PAST, a secure alternative to JWT | https://news.ycombinator.com/item?id=16070394 (2018Jan:361 points,137 comments)

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#62

Post by Scarbutt » Tue, Jan 16, 2018, 2:15 PM UTC

jpalomaki wrote: post #37

Why not use either simple API key or HTTP basic auth? Both are simple to implement and supported by all the tools and libraries. I would consider more complicated solutions only if you first come to conclusion that these simple things are not fit for the purpose. True that some fancy token based solution may reduce database load, but if the API is doing something useful then that one primary key lookup and potentiall…

Why not use either simple API key or HTTP basic auth? Both are simple to implement and supported by all the tools and libraries.

Does basic auth works if the client is a browser and you want to have a nice login screen?

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#63

Post by matwood » Tue, Jan 16, 2018, 2:16 PM UTC

barrystaes wrote: post #41

Do everything via HTTPS, disable HTTP. The login request (POST, dont use url query params) contains username + password. The API replies with a session token (a random string). You can store any metadata relating to this session token in your DB. The API client should this token in every request that requires authentication, often in the header as `Authorization : Bearer 123TheToken456`. JWT: If DB performance become…

I have found the above (sans JWT) to be the simplest, secure method. Do everything over HTTPS, use basic auth or post for the user/pass and return an expiring token, use that token as a Bearer token for all subsequent requests.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#64

Post by 6ue7nNMEEbHcM » Tue, Jan 16, 2018, 2:19 PM UTC

Hi, can someone explain me why SSL client authentication is not widely used? You can use the same protocol you use to authenticate hosts to authenticate users, yet no one seem to do that nowadays. I'm not professional web developer so maybe answer to this question is obvious (but I just don't know it).

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#65

Post by weitzj » Tue, Jan 16, 2018, 2:30 PM UTC

6ue7nNMEEbHcM wrote: post #64

Hi, can someone explain me why SSL client authentication is not widely used? You can use the same protocol you use to authenticate hosts to authenticate users, yet no one seem to do that nowadays. I'm not professional web developer so maybe answer to this question is obvious (but I just don't know it).

Probably good missing browser support.

I mean with support: getting the certs in there.

Once they are in your keychain, clientcerts are really nice.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#66

Post by homero » Tue, Jan 16, 2018, 2:30 PM UTC

6ue7nNMEEbHcM wrote: post #64

Hi, can someone explain me why SSL client authentication is not widely used? You can use the same protocol you use to authenticate hosts to authenticate users, yet no one seem to do that nowadays. I'm not professional web developer so maybe answer to this question is obvious (but I just don't know it).

I also want to know. It's extremely secure. It's also how I'm blocking my origin ip to where only Cloudflare can access it in case it's leaked. Safer and easier than a whitelist.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#67

Post by snomad » Tue, Jan 16, 2018, 2:30 PM UTC

Auth0 and Okta have tons of docs on this. Even if you don't use their services, they have much to read.

Also, here is a good recent video for ASP Net Core 2, that includes extra things like HSTS, etc. Even if your not in ASP, the concepts will be relevant https://www.youtube.com/watch?v=z2iCddrJRY8

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#68

Post by drderidder » Tue, Jan 16, 2018, 2:37 PM UTC

I highly recommend reading "The Do's and Don'ts of Client Authentication on the Web" [1] from MIT. It's rather old and not very well-known, but it's excellent. The concepts provide very useful background info that will serve you well no matter what technology you use to implement your HTTP services, including issues like session hijacking, etc. One of it's best recommendations: avoid roll-your-own solutions. Secondly, I recommend checking out the "auth" example from the expressjs repository on github [2]. It will provide a practical implementation example. Lastly, if you're considering using Express or any similar framework, I recommend checking out "route parameter preconditions". These seem to remain a little-known feature of Express, but they can be particularly useful for applying middleware to entire sets of routes, for example enforcing authentication on anything under a certain path. You can still find screen-casts for route-specific middleware and route parameter preconditions on the Express 2.x documentation site by TJ, the original author [3]. Some of the specific details may have changed in the newer versions of Express, but TJ's explanation of the concepts is simple and clear.

[1] https://pdos.csail.mit.edu/papers/webauth:sec10.pdf [2] https://github.com/expressjs/express/blob/master/examples/au... [3] https://expressjs.com/2x/screencasts.html

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#69

Post by oozzee » Tue, Jan 16, 2018, 2:37 PM UTC

matwood wrote: post #63

barrystaes wrote: post #41

Do everything via HTTPS, disable HTTP. The login request (POST, dont use url query params) contains username + password. The API replies with a session token (a random string). You can store any metadata relating to this session token in your DB. The API client should this token in every request that requires authentication, often in the header as `Authorization : Bearer 123TheToken456`. JWT: If DB performance become…

I have found the above (sans JWT) to be the simplest, secure method. Do everything over HTTPS, use basic auth or post for the user/pass and return an expiring token, use that token as a Bearer token for all subsequent requests.

I’m mostley a FE person at the moment so forgive me for my ignorance but how does the server use the token passed to the client to do auth?

Does it keep a copy somewhere and check against it on every request?

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#70

Post by acdha » Tue, Jan 16, 2018, 2:37 PM UTC

6ue7nNMEEbHcM wrote: post #64

Hi, can someone explain me why SSL client authentication is not widely used? You can use the same protocol you use to authenticate hosts to authenticate users, yet no one seem to do that nowadays. I'm not professional web developer so maybe answer to this question is obvious (but I just don't know it).

For public services, getting users to have keys and install them in their browsers is quite hard.

For APIs, it should be more manageable but many places stumble with key management and a lot of developers were resistant to learning enough about the tooling to do things like manage test instances.