Re:Getting started with designing a Secure REST (Web) API
by weavejester on Thursday February 16, 2012 @08:23AM
(#3598455)
It provides an additional layer of security over HTTPS/BasicAuth, so if your SSL certificate or even the CA is compromised, you retain a degree of security.
On the other hand, it makes it more difficult for developers to access your API; you can't just send requests over Curl, for instance.
Re:Getting started with designing a Secure REST (Web) API
by arethuza on Thursday February 16, 2012 @08:51AM
(#3598546)
Good point about curl - a strong motivation of mine was to make the API easy to access through tools like curl.
[I have seen some discussions about adding explicit support for OAuth in curl]
Re:Getting started with designing a Secure REST (Web) API
by alexchamberlain on Thursday February 16, 2012 @07:09AM
(#3598279)
Using OAuth 2.0, there's no reason to differentiate client and other server access like that.
- For client access to a server, use basic auth over HTTPS
- For client/server to server access, use OAuth
Note - I'm genuinely interested what people think as I'm just finishing off a personal project using a RESTful interface and this is the approach I have used so far.
[Edited based on comment - and I should point out that I haven't implemented OAuth yet but I should really check out how it would work].