3 ms·
As long as you're talking to your service over SSL, basic auth is the way to go for non-human APIs. As for hiding it from regular users, just make sure you nev
by frankus 17y ago
As long as you're talking to your service over SSL, basic auth is the way to go for non-human APIs.
As for hiding it from regular users, just make sure you never send a 401 response. If the user has accessed a protected resource without providing an authentication cookie, send a 302 to your login page like you (probably) normally would.
Ideally API users would get a 401 to prompt them to supply authentication, but if you can count on API users supplying their credentials with every request, you avoid that issue. And if that really bugs you you can probably figure out from the headers whether you're talking to a browser or a web service and send the appropriate response.
- lsc 17y agoHuh. I thought you could just adjust your 401 error page HTML, just like you can adjust your 404 error page HTML... instead of putting something cute on it, you could put your login page on it.
- frankus 17y agoYou can adjust the HTML, but the browser will pop up a login dialog any time it gets a 401 HTTP status code from the server (unless it has saved credentials). Safari btw will try to request every page without sending the credentials first, and then retry when it gets a 401.