News for hackers. Stuff that matters.

A comment on Ask HN: What's the recommended method of adding authentication to a REST API?. Parent comment

Re:Ask HN: What's the recommended method of adding authentic... by iEchoic on Tuesday January 16, 2018 @08:54AM (#16158130)
> Drawback with tokens and skipping the DB check is that you can't simply kill a client behaving badly.

You can solve this with a token/user blacklist. There are desirable (and undesirable) characteristics of using a blacklist instead of a whitelist, but you don't lose this capability.

[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by mattbroekhuis on Tuesday January 16, 2018 @09:55AM (#16158573)
How do you share your blacklist across servers
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by DanHulton on Tuesday January 16, 2018 @10:15AM (#16158711)
The same way you share any of your other data across servers. Save it in a DB or Redis instance that all your servers can reach.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by eropple on Tuesday January 16, 2018 @10:55AM (#16159056)
At which point you're hitting it on every request and since it'll be a nice, fast, indexed database lookup you might as well just use session tokens instead of a back-assward blacklist.

Do the simplest thing that will work.

[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by iEchoic on Wednesday January 17, 2018 @01:18PM (#16170282)
As I mentioned, blacklists have different characteristics, some of which are desirable. A blacklist of tokens is (for the vast majority of use cases) orders of magnitude smaller than a whitelist, which means they can often be replicated into memory for in-memory lookups on the webserver.

This is a complex distributed systems topic, and there are applications for both.

[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by eropple on Wednesday January 17, 2018 @02:30PM (#16170959)
There are cases where a blacklist totally makes sense, I will agree with you on that.

"I can access this thing" are totally not that for the 99.9% case. Do the simplest thing that will work--and the simplest thing so very rarely involves public-key cryptography!

[ Parent | on HN ]