News for hackers. Stuff that matters.

A comment on Ask HN: What's the recommended method of adding authentication to a REST API?. Parent comment

Re:Ask HN: What's the recommended method of adding authentic... by Blazespinnaker on Wednesday January 17, 2018 @01:28AM (#16165915)
A lot of text for your argument which is x isn't secure. Not very compelling.

Signed rest requests ensure that auth tokens can not be leaked as each request is individually signed by a private key.

Your extreme example btw is hyperbolic. Providing signing sample code to clients is pretty typical

[ Parent | on HN ]
Re:Ask HN: What's the recommended method of adding authentic... by tptacek on Wednesday January 17, 2018 @11:17AM (#16169089)
I'm explaining where I'm coming from as a courtesy. I am also comfortable with the number and kind of HN readers who would simply take my argument as-stated without justification: "don't do signed URLs if you can get away with bearer tokens".
[ Parent | on HN ]