3 ms·
My biggest pain when designing a rest API is a standard authentication method that won't drive me crazy. So far i've always used 3rd party modules to implement
by amingilani 10y ago
My biggest pain when designing a rest API is a standard authentication method that won't drive me crazy. So far i've always used 3rd party modules to implement different kinds of authentication but I never quite understood it in depth.
Apart from HTTP Basic Auth, but please don't use that.
- deleted 10y ago[deleted]
- camus2 10y ago> Apart from HTTP Basic Auth, but please don't use that. What's wrong with basic auth with HTTPS? You can delegate authentication with OAUTH and then use OAUTH for authorization but authentication still has to be done somewhere.
- avenoir 10y agoI think Twillio API still uses or used basic auth via HTTPS.
- tomschlick 10y agoSo does Stripe. There is nothing wrong with basic auth for api tokens so long as you're using HTTPS.
- zeveb 10y ago> What's wrong with basic auth with HTTPS? The only thing wrong that I can see is that it's 2017 and the browsers still don't have a good (indeed, AFAIK, any) UI for logging out.
- nandhp 10y agoOr for staying logged in across sessions (or not). But it should be fine for an API.
- johnjuuljensen 10y agoBasic auth is great. It lowers the barrier of entry, to anyone with a browser. Not all users of APIs are developers.
- fixermark 10y agohttps basic auth, I assume you mean. For http basic auth, you may as well just "secure" the resource by hosting it at http://my-username-and-password.example.com http://my-username-and-password.example.com or http://example.com/username/password/resource http://example.com/username/password/resource
- johnjuuljensen 10y agoI thought https was implied these days :) Yes absolutely https.