Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting started with designing a Secure REST (Web) API

thebuzzmedia.com

Post reply on HN
Print view View original

11–17 of 17 posts

Re: Getting started with designing a Secure REST (Web) API

#11

Post by tfb »

steverb wrote: post #6
abhaga wrote: post #5

Earlier quoted context omitted.

His solution turns out to be close to OAuth 2.0 in the end, so you are right. But I liked the article because it walks you through the thought process of someone trying to do it on their own. This understanding of all the small things you may end up ignoring in your own efforts actually makes a stronger case for OAuth then believing an expert's words.

Actually, it was basically 2-Legged OAuth 1. I was shaking my head all the way through the article, having gone through the same process about a year and a half ago. We (developers) do love re-inventing wheels.

When I need to learn about a wheel, I usually attempt to re-invent it. But in practice (production), I tend to choose a wheel that someone else has already spent years making perfectly round.

What is learned from re-inventing definitely provides unique insight into how the better wheels are actually spinning and ultimately helps us make better use of it.

Re: Getting started with designing a Secure REST (Web) API

#12

Post by tptacek »

A client creates a unique HMAC (hash) representing it’s request to the server

[CLIENT] Hash (HMAC-SHA1 or SHA256 preferably) the blob of data data (from Step #1) with your private key assigned to you by the system.

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!

HMAC isn't a hash. It's not interchangeable with a hash. HMAC is a MAC. If you try to use a standard hash function to create a MAC, it will blow up in your face. This article is not good, in multiple ways; you should disregard it.

Re: Getting started with designing a Secure REST (Web) API

#13

Post by arethuza »

arethuza wrote: post #2

What's wrong with an approach of: - For client access to a server, use basic auth over HTTPS - For client/server to server access, use OAuth Note - I'm genuinely interested what people think as I'm just finishing off a personal project using a RESTful interface and this is the approach I have used so far. [Edited based on comment - and I should point out that I haven't implemented OAuth yet but I should really check…

Another one I forgot that might be relevant to what I am working on - Windows Integrated Authentication.

Re: Getting started with designing a Secure REST (Web) API

#14

Post by alexchamberlain »

abhaga wrote: post #5
alexchamberlain wrote: post #3

I didn't read this for one simple reason - the dismissal of OAuth as complex. It's not that bad and it is secure. It's proven secure by experts and open source libraries exist.

His solution turns out to be close to OAuth 2.0 in the end, so you are right. But I liked the article because it walks you through the thought process of someone trying to do it on their own. This understanding of all the small things you may end up ignoring in your own efforts actually makes a stronger case for OAuth then believing an expert's words.

I'm not saying that we should all use OAuth 2.0 without due understanding, but we should all admit that we're not all experts at everything, and sometimes we should bow to peer reviewed knowledge.

Re: Getting started with designing a Secure REST (Web) API

#15

Post by loganfrederick »

steverb wrote: post #6
abhaga wrote: post #5

Earlier quoted context omitted.

His solution turns out to be close to OAuth 2.0 in the end, so you are right. But I liked the article because it walks you through the thought process of someone trying to do it on their own. This understanding of all the small things you may end up ignoring in your own efforts actually makes a stronger case for OAuth then believing an expert's words.

Actually, it was basically 2-Legged OAuth 1. I was shaking my head all the way through the article, having gone through the same process about a year and a half ago. We (developers) do love re-inventing wheels.

Do you have any recommended tutorials/walkthroughs for building a REST API?

Re: Getting started with designing a Secure REST (Web) API

#16

Post by icebraining »

loganfrederick wrote: post #15
steverb wrote: post #6

Earlier quoted context omitted.

Actually, it was basically 2-Legged OAuth 1. I was shaking my head all the way through the article, having gone through the same process about a year and a half ago. We (developers) do love re-inventing wheels.

Do you have any recommended tutorials/walkthroughs for building a REST API?

http://shop.oreilly.com/product/9780596529260.do

Re: Getting started with designing a Secure REST (Web) API

#17

Post by smuggyuk »

Does anyone have any comments on protecting the private key / API in an unsecure client (such as Javascript, or a mobile app where the source code can be readily viewed)? He mentions it in this article, but no one seems to address it in the comments and the solution offered of "reset the private key" doesn't seem terribly secure.
Post reply on HN