3 ms·

OAuth2 is the way to go for REST services especially if you plan to let users give other apps/developers access without giving out their passwords. For better

OAuth2 is the way to go for REST services especially if you plan to let users give other apps/developers access without giving out their passwords. For better security, you want to decouple the authentication server from your web application (2 separate databases at least) The authentication server stores email/username, encrypted password, and roles. To access the web app, you first get a token from the authentication server by exchanging a client_id, secret, username, password and grant type. The token is used whenever you want to make a request to the web app. The authentication server has an endpoint that lets the web app check to see if the token is valid and what roles the client has. The token is only valid for a short time and can be revoked. To know who is making the request, you associate the username/email from the authentication server with a user object on the web application so you can look up based on username/email. It's not worth doing this from scratch as there are plenty of open source implementations out there already like Spring Security Oauth2 and other libraries for Django/python, but they all require some reading to get started. I've used Spring Security Oauth2, but it's not very well documented. I've thought about open sourcing my work, but not sure yet.

aprdm 10y ago
Isn't having two distinct servers one for auth and one for business logic too much for small start ups / services? I can see the benefit when scaling but starting with this design seems to be a little bit of an overkill / harder to manage? Care to elaborate? Cheers
- jaypaulynice 10y ago
  For a quick prototype, I think it's ok to have both in same server/database, but beyond a prototype you should think about security and scaling. Redesigning later can be a nightmare and most people end up not doing it instead just leaving what they already have. The good thing with 2 separate servers is that if one is compromised, then the bad actor doesn't get access to all your data. Also you could use any language/database that makes sense for your auth server or services.

aprdm 10y ago

Isn't having two distinct servers one for auth and one for business logic too much for small start ups / services? I can see the benefit when scaling but starting with this design seems to be a little bit of an overkill / harder to manage? Care to elaborate? Cheers

jaypaulynice 10y ago
For a quick prototype, I think it's ok to have both in same server/database, but beyond a prototype you should think about security and scaling. Redesigning later can be a nightmare and most people end up not doing it instead just leaving what they already have. The good thing with 2 separate servers is that if one is compromised, then the bad actor doesn't get access to all your data. Also you could use any language/database that makes sense for your auth server or services.