Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What's the recommended method of adding authentication to a REST API?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 254 posts

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#91

Post by jandrese »

6ue7nNMEEbHcM wrote: post #81
acdha wrote: post #70

Earlier quoted context omitted.

For public services, getting users to have keys and install them in their browsers is quite hard. For APIs, it should be more manageable but many places stumble with key management and a lot of developers were resistant to learning enough about the tooling to do things like manage test instances.

I guess regarding the public services your statement may be correct. But I wonder if anyone (any significant content provider) actually tried. The technology is available for > 10 years at least (including browsers support). I think it's an issue for most people that they need to manage multiple passwords and it sometimes turns off people from actually using the service. With client certificates you install certifica…

Startcom does client certificate authentication.

The hassle is that you need to install the certificate on every device you want to access the page from.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#92

Post by cagmz »

drderidder wrote: post #68

I highly recommend reading "The Do's and Don'ts of Client Authentication on the Web" [1] from MIT. It's rather old and not very well-known, but it's excellent. The concepts provide very useful background info that will serve you well no matter what technology you use to implement your HTTP services, including issues like session hijacking, etc. One of it's best recommendations: avoid roll-your-own solutions. Secondly…

React router supports a similar pattern to Express, although they seem to be called "protected routes" [1].

[1] https://tylermcginnis.com/react-router-protected-routes-auth...

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#93

Post by j_s »

rkangel wrote: post #90
6ue7nNMEEbHcM wrote: post #64

Hi, can someone explain me why SSL client authentication is not widely used? You can use the same protocol you use to authenticate hosts to authenticate users, yet no one seem to do that nowadays. I'm not professional web developer so maybe answer to this question is obvious (but I just don't know it).

I have worked with systems that use it to authenticate machine to machine communication (e.g. a web backend authenticating itself to another service doing work for it). In that environment it works well. Using it to authenticate a person regardless of device doesn't work so well from a usability point of view.

I've been experimenting with using the server's public SSL key as a client certificate to authenticate self-hosted and cross-server web service requests since the cert should be available at runtime in common enterprise setups yet incentives align to keep it well-secured.

I would appreciate pointers to any open source libraries demonstrating best practices and/or promoting this approach, specifically protecting against replay attacks and race conditions that come up as the cert is renewed (much more often - thanks Let's Encrypt!).

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#94

Post by tboyd47 »

Authentication is such a mess, I don't even know where to begin. Most APIs rely on some sort of token-based auth, communicated via the header format: "Authorization: Bearer abc123", as opposed to placing it in the Cookie, as most web sites will do. Many solutions exist, like OAuth2, JWT, etc. but that's ultimately what it all boils down to.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#97

Post by matwood »

oozzee wrote: post #69
matwood wrote: post #63

Earlier quoted context omitted.

I have found the above (sans JWT) to be the simplest, secure method. Do everything over HTTPS, use basic auth or post for the user/pass and return an expiring token, use that token as a Bearer token for all subsequent requests.

I’m mostley a FE person at the moment so forgive me for my ignorance but how does the server use the token passed to the client to do auth? Does it keep a copy somewhere and check against it on every request?

> Does it keep a copy somewhere and check against it on every request?

Yep, a store like Redis that has automatic row expiration is what I have used in the past. Most clients will often be bursty in their requests so a simple few second cache on API after verifying the token can also be useful/performant.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#98

Post by bascule »

6ue7nNMEEbHcM wrote: post #64

Hi, can someone explain me why SSL client authentication is not widely used? You can use the same protocol you use to authenticate hosts to authenticate users, yet no one seem to do that nowadays. I'm not professional web developer so maybe answer to this question is obvious (but I just don't know it).

Client certificates, a.k.a. mutual TLS or "MTLS" authentication, are widely used within infrastructural deployments of TLS, where there are automated mechanisms to provision and rotate certificates.

For federated use cases, they are less popular, likely due to the added complexity being a blocker for adoption.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#99

Post by liquidise »

EngineerBetter wrote: post #60

It makes me sad that in 2018 that it is entirely reasonable for such a simple and common question to elicit so many answers. Of course no one solution fits all use cases, but skimming the comments there seems to be a very diverse range of suggestions. Wouldn't it be lovely if there was one stand-out solution that was so good it was a no-brainer? FWIW I have ended up using OAuth2 for this situation a few times, and it…

This is arguably self-serving but I am happy there isn’t one. The appeal to coding is that it hasn’t matured to being computerized LEGO’s, where I spend my time connecting prebuilt components unspecialized for my application.

But we are not alone in this regard. Bridge building is centuries more mature than software engineering and their shapes, materials and construction methods still change regularly. I would expect to see this trend remain for a long time. Engineering is an inherently creative practice, often staffed by appropriately creative people. The continued evolution, including the trial and error approach, are likely to continue for decades.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#100

Post by Daycrawler »

It depends on the use-case.

* Public data API (no notion of user account, e.g. weathers API, newspapers API, GitHub public events, Reddit /r/popular, etc): use an API key. The developers must create an account on your website to create their API key; each API call is accompanied by the API key in the query string (?key=...)

* Self-used API for AJAX (notion of user account, e.g. all the AJAX calls behind the scenes when you use Gmail): use the same user cookie as for the rest of the website. The API is like any other resource on the website except it returns JSON/XML/whatever instead of HTML.

* Internal API for micro-services: API key shared by both ends of the service. There can be a notion of user accounts, but it's a business notion and the user is an argument like any other. If possible, your micro-services shouldn't actually be accessible on the public Internet.

* API with the notion of user accounts intended for third-parties (e.g. Reddit mobile app where the users can authorize the app to use their Reddit account on their behalf): OAuth2

Post reply on HN