News for hackers. Stuff that matters.

A comment on Ask HN: What's the recommended method of adding authentication to a REST API?. Parent comment

Re:Ask HN: What's the recommended method of adding authentic... by tptacek on Tuesday January 16, 2018 @11:53AM (#16159624)
The downside to allowing multiple tokens is that in the real world, people will create new tokens for new deployment environments, but never delete the old ones, which will inevitably end up on Github somehow.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by jdc0589 on Tuesday January 16, 2018 @12:10PM (#16159800)
agreed, but its a solvable problem.

e.g. You can request a second token, but doing so immediately sets the currently active token to expire and be deleted in X days.

[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by tptacek on Tuesday January 16, 2018 @12:15PM (#16159857)
Sorry, I made it sound like I think multiple tokens is an illegitimate choice. It's not; I just think, be aware of the tradeoffs and keep things as simple as they can possibly be.
[ Parent | on HN ]