Re:API Design Guide
by johnjuuljensen on Wednesday February 22, 2017 @02:21PM
(#13708358)
Basic auth is great. It lowers the barrier of entry, to anyone with a browser.
Not all users of APIs are developers.
https basic auth, I assume you mean.
For http basic auth, you may as well just "secure" the resource by hosting it at http://my-username-and-password.example.com or http://example.com/username/password/resource
Re:API Design Guide
by johnjuuljensen on Wednesday February 22, 2017 @03:49PM
(#13709010)
I thought https was implied these days :)
Yes absolutely https.
> Apart from HTTP Basic Auth, but please don't use that.
What's wrong with basic auth with HTTPS? You can delegate authentication with OAUTH and then use OAUTH for authorization but authentication still has to be done somewhere.
> What's wrong with basic auth with HTTPS?
The only thing wrong that I can see is that it's 2017 and the browsers still don't have a good (indeed, AFAIK, any) UI for logging out.
Or for staying logged in across sessions (or not). But it should be fine for an API.
I think Twillio API still uses or used basic auth via HTTPS.
Re:API Design Guide
by tomschlick on Wednesday February 22, 2017 @05:03PM
(#13709630)
So does Stripe. There is nothing wrong with basic auth for api tokens so long as you're using HTTPS.
Apart from HTTP Basic Auth, but please don't use that.