Ask HN: What's the recommended method of adding authentication to a REST API?

Re:Ask HN: What's the recommended method of adding authentic... by hundt on Tuesday January 16, 2018 @11:50AM (#16159574)

Thanks for the response!

My thinking was that you might sign requests so that a request that was intercepted or inadvertently logged would not contain sufficient credentials to authorize arbitrary other requests for the indefinite future. It sounds like you do not consider that a significant enough issue to justify the complexity involved.

[ Parent | on HN ]

Re:Ask HN: What's the recommended method of adding authentic... by dboreham on Tuesday January 16, 2018 @11:56AM (#16159654)

Good point: Credentials must not be logged. The easiest way to achieve this is to use HTTP basic auth for the token because web server infrastructure already knows not to log that, or a header OAuth2 style.

[ Parent | on HN ]

Re:Ask HN: What's the recommended method of adding authentic... by tptacek on Tuesday January 16, 2018 @11:55AM (#16159646)

No. You need to be securely using TLS anyways. Signed requests are hard to get right (Google "canonicalization vulnerabilities"). That's not a good tradeoff.

[ Parent | on HN ]