Secure Your REST API
stormpath.com
Secure Your REST API
1–10 of 80 posts
Re: Secure Your REST API
#2Didn't oAuth2 support signed requests via MAC token on request?
Re: Secure Your REST API
#3Please stop using the term UUID when you mean 'random alphanumeric string'. Because UUIDs have a standardized format (it's not just a random string): http://en.wikipedia.org/wiki/Universally_unique_identifier
Re: Secure Your REST API
#4In my humble opinion, security through obscurity via UUIDS rather than sequential integers is not great advice. It merely masks the real problem.
Re: Secure Your REST API
#5Please stop using the term UUID when you mean 'random alphanumeric string'. Because UUIDs have a standardized format (it's not just a random string): http://en.wikipedia.org/wiki/Universally_unique_identifier
UUID v4 is, in fact, random and "alphanumeric" in the sense that it's hex.
That being said, I have a few other issues with their wording as well. They should just say "we have a custom HMAC-based authentication scheme for our REST API". Also, it took me about 3 days to realize HMAC over SSL/TLS is about as secure and easy as you can get for most any language -- If you can send HTTP requests, you can probably do HMAC. You can add further safety by making expiring private keys for HMAC and other things, although my use cases are based on long running (weeklong+) batch computations, and not end users. (i.e. initial distribution of an expiring private key for HMAC over SSL, reauthentication schemes, etc...
Re: Secure Your REST API
#6Does anyone know of a good reason not to use TLS with client-side certificates (and you as the CA) for API authentication?
Re: Secure Your REST API
#7Does anyone know of a good reason not to use TLS with client-side certificates (and you as the CA) for API authentication?
Yeah, limited library support for client certs.
Re: Secure Your REST API
#8Shoots down Basic auth without SSL, without mentioning Digest auth, weird.
Re: Secure Your REST API
#9Please stop using the term UUID when you mean 'random alphanumeric string'. Because UUIDs have a standardized format (it's not just a random string): http://en.wikipedia.org/wiki/Universally_unique_identifier
UUID v4 is, in fact, random and "alphanumeric" in the sense that it's hex. That being said, I have a few other issues with their wording as well. They should just say "we have a custom HMAC-based authentication scheme for our REST API". Also, it took me about 3 days to realize HMAC over SSL/TLS is about as secure and easy as you can get for most any language -- If you can send HTTP requests, you can probably do HMAC.…
It's not just random, it's a standard requiring some hex digits to be non-random (4, 8, 9, a, b). Otherwise it won't validate as a UUID4.
Re: Secure Your REST API
#10Shoots down Basic auth without SSL, without mentioning Digest auth, weird.
That's a good suggestion - will see if we can add a para about it. We use digest authentication, fwiw.