News for hackers. Stuff that matters.

A comment on Ask HN: What's the recommended method of adding authentication to a REST API?. Parent comment

Re:Ask HN: What's the recommended method of adding authentic... by tptacek on Tuesday January 16, 2018 @11:54AM (#16159636)
The AWS API runs over TLS, and uses signed requests.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by dboreham on Tuesday January 16, 2018 @10:51PM (#16165325)
Perhaps because it was originally designed for use without TLS? Request signing was pretty much ubiquitous 10 years ago.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by Promarged on Wednesday January 17, 2018 @05:03AM (#16166776)
I'm not from Amazon but I'd guess they want to protect the request from being replayed inside their own systems.
[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by sloxy on Wednesday January 17, 2018 @07:42AM (#16167409)
more likely it's so they don't have to have a more convoluted process where they call out to requesting service to verify RQ & all which that entails (on both sides).
[ Parent | on HN ]