Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What's the recommended method of adding authentication to a REST API?

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 254 posts

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#151

Post by mattmanser »

brabel wrote: post #75
mattmanser wrote: post #47

Earlier quoted context omitted.

Can you explain why only "public non-user-specific data" is suitable for basic auth over HTTPS? For most SasS products, basic auth or an API key is going to be fine. In fact, a ton of SasS vendors do exactly that. It's also totally fine for, say, an enterprise API used by a partner or clients. Oauth is a cluster-fuck of terribleness, a nightmare for you to work with and a nightmare for your consumers to use. If you d…

The OAuth use case you mention is spot on but with OAuth clients available in every language remotely popular I don't agree it's complicated. And I think that even if you don't have a strong user case for OAuth you will sooner or later. Better to go with the standard practice for user centric APIs instead of using ad hoc solutions.

It is vastly more complicated, you have to do all sorts of redirecting and capturing with OAuth that you simply don't have to do with basic authentication.

And woe betide you if you're not using a framework that vaguely plugs + plays oauth.

Couple that with all the shennanigans involved when trying to get two servers to talk to each other without a human involved in oauth.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#152

Post by trevor-e »

liquidise wrote: post #99
EngineerBetter wrote: post #60

It makes me sad that in 2018 that it is entirely reasonable for such a simple and common question to elicit so many answers. Of course no one solution fits all use cases, but skimming the comments there seems to be a very diverse range of suggestions. Wouldn't it be lovely if there was one stand-out solution that was so good it was a no-brainer? FWIW I have ended up using OAuth2 for this situation a few times, and it…

This is arguably self-serving but I am happy there isn’t one. The appeal to coding is that it hasn’t matured to being computerized LEGO’s, where I spend my time connecting prebuilt components unspecialized for my application. But we are not alone in this regard. Bridge building is centuries more mature than software engineering and their shapes, materials and construction methods still change regularly. I would expec…

I do agree with your sentiment, but is creativity something we want to encourage with security? Security is hard, and most developers won't know when they've made a mistake implementing something. The laws of physics haven't changed for bridge builders. In the end, everyday consumers are the ones suffering from the recent hacks.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#153

Post by matwood »

MichaelGG wrote: post #150
matwood wrote: post #110

Earlier quoted context omitted.

> but requires that the client retain the non-expiring username and password IMO, this makes this simpler solution a non-starter. It becomes way too easy to leak credentials.

How so? The client needs to have the username and password to call the login function over and over, as well as managing the session token. It's just incredibly annoying with no benefits in nearly every scenario.

The client should not store the user/pass [1]. If the token expires, the user needs to provide a user/pass to login in again. The user should also be forced to provide a user/pass in order to change the password - something that cannot be enforced if keeping the user/pass on the client.

You also lose any method to force a re-authentication. With a token, I could expire with no activity for an hour and allow it to be good for a max of 2 hours.

[1] Users have a bad habit of just leaving computers. With a token, the worst case is someone has a short lived access to to something. With a user/pass left on the client worst case now becomes use/pass taken.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#154

Post by thwiv »

Blazespinnaker wrote: post #149
tptacek wrote: post #116

This question comes up all the time on HN. I'm one of a bunch of people on HN that do this kind of work professionally. Here's a recent comment on a recent story about it: https://news.ycombinator.com/item?id=16006394 The short answer is: don't overthink it. Do the simplest thing that will work: use 16+ byte random keys read from /dev/urandom and stored in a database. The cool-kid name for this is "bearer tokens". Yo…

Signed REST requests are good too, more secure. And what’s wrong with delegated auth?

There's nothing wrong with delegated auth, but in this situation you're not doing any delegation.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#155

Post by matwood »

mring33621 wrote: post #111
pc86 wrote: post #89

Earlier quoted context omitted.

> Does it keep a copy somewhere and check against it on every request? Yes. The last time I did this we checked the X-Token header on every request, if it didn't exist or there were multiple we replied 401. If only one was there we checked a DB table of active tokens, if it wasn't there or had expired we replied 401. If it was there but wasn't associated with a role that had access to the requested resource, we repli…

I was planning to use custom headers over HTTPS for a similar thing, but then I read that some firewalls will strip custom headers, even over HTTPS. Can anyone with experience comment? Thanks.

Just use a Bearer token in the Authorization header from the OAuth spec: https://tools.ietf.org/html/rfc6750#section-2.1

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#156

Post by yebyen »

riquito wrote: post #148
iopuy wrote: post #146

Earlier quoted context omitted.

Is it not true that Basic Authentication requires TLS due to transporting credentials as plain text but other variations encrypt the credentials at a higher level before being put on the wire? In that case why is TLS a necessity?

It's necessary because otherwise the encrypted credentials could be copied and used to access the service.

It's not a given that something like Diffie-Helman shared secret is going to put the actual secret on the wire during authentication, or that smart auth strategies similar to this one that don't directly transmit secrets are always going to be susceptible to replay attacks.

(I am a dog on the internet, so don't listen to me. I also heard that the best way to get a really good answer is not just to ask any old question, but to give a wrong answer...)

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#157

Post by jhanschoo »

ixtli wrote: post #113
6ue7nNMEEbHcM wrote: post #64

Hi, can someone explain me why SSL client authentication is not widely used? You can use the same protocol you use to authenticate hosts to authenticate users, yet no one seem to do that nowadays. I'm not professional web developer so maybe answer to this question is obvious (but I just don't know it).

Personally I've always used x509 client certs with a self signed root authority / intermediate authority for internal tooling at companies i've worked for. This is possible because 1) i happen to already have a good understanding of openssl and how to use it, secure keys 2) i have control over the devices im provisioning so i can make them trust my root cert for timing/x509/etc. It would be really cool if there was a…

Considering that mozilla is one of the founding members of Let's Encrypt, I think and hope that they are pretty competent in PKI.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#158

Post by jmulho »

tboyd47 wrote: post #94

Authentication is such a mess, I don't even know where to begin. Most APIs rely on some sort of token-based auth, communicated via the header format: "Authorization: Bearer abc123", as opposed to placing it in the Cookie, as most web sites will do. Many solutions exist, like OAuth2, JWT, etc. but that's ultimately what it all boils down to.

Is there any reason to favor bearer tokens over cookies?

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#159

Post by tptacek »

Blazespinnaker wrote: post #149
tptacek wrote: post #116

This question comes up all the time on HN. I'm one of a bunch of people on HN that do this kind of work professionally. Here's a recent comment on a recent story about it: https://news.ycombinator.com/item?id=16006394 The short answer is: don't overthink it. Do the simplest thing that will work: use 16+ byte random keys read from /dev/urandom and stored in a database. The cool-kid name for this is "bearer tokens". Yo…

Signed REST requests are good too, more secure. And what’s wrong with delegated auth?

Signed requests are not in general more secure:

* The implementation of cryptographic "signing" (really, virtually never signing but rather message authentication) is susceptible to implementation errors.

* The concept of signing is susceptible to an entire class of implementation errors falling under the category of "quoting and canonicalization". See: basically every well-known implementation of "signed URLs" for examples.

* Signed URLs have to make their own special arrangements for expiration and replay protection in ways that stateful authentication doesn't, either because the stateful implementation is trivial or because stateful auth "can't" do the things stateful auth can (like explicitly handing off a URL to a third party for delegated execution).

Stateless authentication is almost never a better idea than stateful authentication. In the real world, most important APIs are statefully authenticated. This is true even in a lot of cases where those APIs (inexplicably) use JWTs, as you discover when you get contracted to look at the source code.

Delegated authentication is useful situationally. But really, there aren't all that many situations where it's needed. It's categorically not useful as a default; it's a terrible, dangerous default.

Re: Ask HN: What's the recommended method of adding authentication to a REST API?

#160

Post by ixtli »

newscracker wrote: post #121
ixtli wrote: post #113

Earlier quoted context omitted.

Personally I've always used x509 client certs with a self signed root authority / intermediate authority for internal tooling at companies i've worked for. This is possible because 1) i happen to already have a good understanding of openssl and how to use it, secure keys 2) i have control over the devices im provisioning so i can make them trust my root cert for timing/x509/etc. It would be really cool if there was a…

In Firefox, there's a configuration setting (from about:config) in Windows (not sure about other OSes) that can be used to tell Firefox to use the system certificate store for root CAs. There are also deployment mechanisms where this can be pushed as one of the default policies. [1] The Firefox Enterprise mailing list is the place to go to for deeper level help on these things. [2] [1]: https://wiki.mozilla.org/CA:Ad…

Thank you! It's always just been a passing annoyance so I never bothered to look into it, but TIL.
Post reply on HN