Ask HN: What's the recommended method of adding authentication to a REST API?

Re:Ask HN: What's the recommended method of adding authentic... by sidhuko on Tuesday January 16, 2018 @05:13AM (#16157059)

For users or applications within your own network?

[ Parent | on HN ]

Re:Ask HN: What's the recommended method of adding authentic... by somtum on Tuesday January 16, 2018 @05:16AM (#16157080)

What would you recommend for both?

[ Parent | on HN ]

Re:Ask HN: What's the recommended method of adding authentic... by sidhuko on Tuesday January 16, 2018 @05:55AM (#16157256)

For applications using a HMAC token with some sort of timestamp which can be checked for replay attacks. AWS has a good guide: https://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthenti....

For users, I'd add a OAuth layer to the application layer and still have this application using a HMAC like above. You want to try keep things 'stateless' when it comes to your API's.

[ Parent | on HN ]

Re:Ask HN: What's the recommended method of adding authentic... by mcjiggerlog on Tuesday January 16, 2018 @05:42AM (#16157197)

Within your own network a simple key/secret combination is enough, as the secret can just be stored as an environment variable, for example.

For users you'd need some way for the users to "fetch the secret", which is effectively what logging in is. At that point you should just use JWT or oAuth.

[ Parent | on HN ]