Newbie Question: What is a secure and accepted way for authentication and authorisation of REST API endpoint for mobile and SPA's? A google search usually yields JWT but from what I know about JWT, it's complex and doesn't support revocation of tokens easily.
Ask HN: What is the best way to add authentication to REST API (for mobile)?
1–10 of 23 posts
Re: Ask HN: What is the best way to add authentication to REST API (for mobile)?
#2An API Gateway is pretty Quick to set up, but the industry is moving away from it as a concept.
Keycloak is nice but requires some work.
Re: Ask HN: What is the best way to add authentication to REST API (for mobile)?
#3JWT is not that complex because there are battle tested libraries available for all languages.
Re: Ask HN: What is the best way to add authentication to REST API (for mobile)?
#4Auth0 is not a bad option.
For JWT to support revocation, you must store them in the database and delete them on logout or when they expire.
Re: Ask HN: What is the best way to add authentication to REST API (for mobile)?
#5Use a session cookie.
Re: Ask HN: What is the best way to add authentication to REST API (for mobile)?
#6If you're using AWS, maybe take a look at Cognito?
https://docs.aws.amazon.com/cognito/latest/developerguide/wh...
Re: Ask HN: What is the best way to add authentication to REST API (for mobile)?
#7An API Gateway is pretty Quick to set up, but the industry is moving away from it as a concept. Keycloak is nice but requires some work.
> An API Gateway is pretty Quick to set up, but the industry is moving away from it as a concept.
Can you elaborate on this?
Re: Ask HN: What is the best way to add authentication to REST API (for mobile)?
#8If you control both the backend and the front end, just use a session cookie.
Re: Ask HN: What is the best way to add authentication to REST API (for mobile)?
#9Auth0 is not a bad option. For JWT to support revocation, you must store them in the database and delete them on logout or when they expire.
To clarify for JWT invalidation, you don’t have to store the whole token. Instead just store the jti or some other identifying field that can be checked.
Re: Ask HN: What is the best way to add authentication to REST API (for mobile)?
#10Auth0 is not a bad option. For JWT to support revocation, you must store them in the database and delete them on logout or when they expire.
To clarify for JWT invalidation, you don’t have to store the whole token. Instead just store the jti or some other identifying field that can be checked.
Can you please elaborate on this?