News for hackers. Stuff that matters.
Re:Getting started with designing a Secure REST (Web) API by alexchamberlain on Thursday February 16, 2012 @07:09AM (#3598277)
I didn't read this for one simple reason - the dismissal of OAuth as complex. It's not that bad and it is secure. It's proven secure by experts and open source libraries exist.
Re:Getting started with designing a Secure REST (Web) API by abhaga on Thursday February 16, 2012 @07:24AM (#3598314)
His solution turns out to be close to OAuth 2.0 in the end, so you are right. But I liked the article because it walks you through the thought process of someone trying to do it on their own. This understanding of all the small things you may end up ignoring in your own efforts actually makes a stronger case for OAuth then believing an expert's words.
Re:Getting started with designing a Secure REST (Web) API by steverb on Thursday February 16, 2012 @08:19AM (#3598443)
Actually, it was basically 2-Legged OAuth 1. I was shaking my head all the way through the article, having gone through the same process about a year and a half ago.

We (developers) do love re-inventing wheels.

Re:Getting started with designing a Secure REST (Web) API by tfb on Thursday February 16, 2012 @09:06AM (#3598613)
When I need to learn about a wheel, I usually attempt to re-invent it. But in practice (production), I tend to choose a wheel that someone else has already spent years making perfectly round.

What is learned from re-inventing definitely provides unique insight into how the better wheels are actually spinning and ultimately helps us make better use of it.

Re:Getting started with designing a Secure REST (Web) API by loganfrederick on Thursday February 16, 2012 @11:29AM (#3599375)
Do you have any recommended tutorials/walkthroughs for building a REST API?
Re:Getting started with designing a Secure REST (Web) API by icebraining on Thursday February 16, 2012 @03:23PM (#3600494)
Re:Getting started with designing a Secure REST (Web) API by alexchamberlain on Thursday February 16, 2012 @09:40AM (#3598824)
I'm not saying that we should all use OAuth 2.0 without due understanding, but we should all admit that we're not all experts at everything, and sometimes we should bow to peer reviewed knowledge.