No post body was provided.
Ask HN: What's the recommended method of adding authentication to a REST API?
1–10 of 254 posts
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#2For users or applications within your own network?
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#3For users or applications within your own network?
What would you recommend for both?
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#4I suggest JSON Web Tokens. Check this out https://jwt.io/introduction/
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#5Auth Tokens are easy to work with for customers and the API developers. Generate a token, and then authenticate. I prefer them.
http://page.rest does a good job.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#6Oauth2 tokens or jwt.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#7JWT is pretty easy to understand.
Create a token, put your userId in it, set an expiry date.
If a request comes with a token check if token is valid, check the userId & expiry date otherwise throw error.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#8I think that Auth Tokens are easy to understand, use, and implement. They can generally be invalidated if the developer feels that they have been compromised.
Some APIs also use self-invalidating auth tokens based on an expiry date. For more secure data, I'd prefer that.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#9I’d say it depends a lot.
If your API just serves public non-user-specific data, a simple API key might be okay. The obvious downside of this method is that a user leaking their client API key is a big problem, especially if your users are likely to distribute code that makes requests (e.g. a mobile app that makes requests to your API).
The state of the art is probably still OAuth, where clients regularly request session keys. This means a leaked key probably won’t cause problems for very long. The obvious downside of this is complexity, but that can be mitigated by releasing client libraries that smooth over the process.
Re: Ask HN: What's the recommended method of adding authentication to a REST API?
#10I suggest JSON Web Tokens. Check this out https://jwt.io/introduction/
I would suggest everyone to stay away from jwt unless they're willing to spend the time to learn how it works.
I believe the meta is that jwt is solid itself but allows doing things "wrong". Guardrails so to speak are insufficient if not outright lacking.
I'd say just go with plain text token for a web app. I don't like the idea of trusting the client because I don't understand how jwt works.