How we overcame the security flaws of performing REST API calls in JavaScript

Re:How we overcame the security flaws of performing REST API... by jlemoine on Tuesday March 18, 2014 @12:42AM (#7420219)

We care a lot about the simplicity of our API. oauth adds too much complexity and does not fit well our use case (we don't need authentication).

[ Parent | on HN ]

Re:How we overcame the security flaws of performing REST API... by dmak on Tuesday March 18, 2014 @02:38AM (#7420497)

You don't need to authenticate. You can use OAuth for just authorization: http://tools.ietf.org/html/rfc6749#section-1.3.2

[ Parent | on HN ]

Re:How we overcame the security flaws of performing REST API... by jlemoine on Tuesday March 18, 2014 @02:51AM (#7420530)

But this would reduce the ease of use of the API, increase the latency because of round-trip and will not provide a better security. The fit is not very good.

oauth is a good standard when used for the correct use case, which is not the case for this. Sometime a simple solution is better than a framework

[ Parent | on HN ]