How we overcame the security flaws of performing REST API calls in JavaScript

Re:How we overcame the security flaws of performing REST API... by tantalor on Tuesday March 18, 2014 @12:13AM (#7420108)

I suggest you investigate oAuth instead of rolling something yourself. That's how Google, Facebook, and Twitter solve this problem. Pick whichever version suits your needs,

http://oauth.net/core/1.0a/ (2009)

http://oauth.net/2/ (2012)

[ Parent | on HN ]

Re:How we overcame the security flaws of performing REST API... by tonyhb on Tuesday March 18, 2014 @12:41AM (#7420214)

Out of all of these, I've always found the HMAC hashed request in OAuth 1 to make the most sense from a basic security point of view. The only concern being token refreshes.

[ Parent | on HN ]

Re:How we overcame the security flaws of performing REST API... by jlemoine on Tuesday March 18, 2014 @12:42AM (#7420219)

We care a lot about the simplicity of our API. oauth adds too much complexity and does not fit well our use case (we don't need authentication).

[ Parent | on HN ]

Re:How we overcame the security flaws of performing REST API... by dmak on Tuesday March 18, 2014 @02:38AM (#7420497)

You don't need to authenticate. You can use OAuth for just authorization: http://tools.ietf.org/html/rfc6749#section-1.3.2

[ Parent | on HN ]

Re:How we overcame the security flaws of performing REST API... by jlemoine on Tuesday March 18, 2014 @02:51AM (#7420530)

But this would reduce the ease of use of the API, increase the latency because of round-trip and will not provide a better security. The fit is not very good.

oauth is a good standard when used for the correct use case, which is not the case for this. Sometime a simple solution is better than a framework

[ Parent | on HN ]