News for hackers. Stuff that matters.

A comment on API Design Guide. Parent comment

Re:API Design Guide by camus2 on Wednesday February 22, 2017 @01:09PM (#13707620)
> Apart from HTTP Basic Auth, but please don't use that.

What's wrong with basic auth with HTTPS? You can delegate authentication with OAUTH and then use OAUTH for authorization but authentication still has to be done somewhere.

[ Parent | on HN ]
Re:API Design Guide by zeveb on Wednesday February 22, 2017 @03:36PM (#13708922)
> What's wrong with basic auth with HTTPS?

The only thing wrong that I can see is that it's 2017 and the browsers still don't have a good (indeed, AFAIK, any) UI for logging out.

[ Parent | on HN ]
Re:API Design Guide by nandhp on Wednesday February 22, 2017 @10:07PM (#13711315)
Or for staying logged in across sessions (or not). But it should be fine for an API.
[ Parent | on HN ]
Re:API Design Guide by avenoir on Wednesday February 22, 2017 @01:19PM (#13707706)
I think Twillio API still uses or used basic auth via HTTPS.
[ Parent | on HN ]
Re:API Design Guide by tomschlick on Wednesday February 22, 2017 @05:03PM (#13709630)
So does Stripe. There is nothing wrong with basic auth for api tokens so long as you're using HTTPS.
[ Parent | on HN ]