3 ms·
"And while you're at it, don't use HTTP authentication either. Use signed queries that authentication each API call individually." What is the problem with usi
by jimbobimbo 15y ago
"And while you're at it, don't use HTTP authentication either. Use signed queries that authentication each API call individually."
What is the problem with using digest auth with proper request counter (nc) incrementing done over HTTPS?
- boucher 15y agoWhat's the problem with HTTP Basic auth over HTTPS?
- bbsabelli 15y agoCost?
- daredevildave 15y agoIsn't "signed queries" the same as 2-legged OAuth?
- stanleydrew 15y agoThere's nothing wrong with it or with HTTP Basic Auth over HTTPS either for that matter. The author doesn't seem to understand that HTTP Basic/Digest Auth is effectively exactly what he wants: a signed request that authenticates each API call. The fact that it goes in an HTTP header rather than some query parameter or something in the request body is only relevant in the case that users of your API don't have the ability to manipulate headers. This is a vanishingly small set of users. Whether they know how to do it or not is another matter.
- psadauskas 15y agoThe problem with it is that you can't cache it in an intermediate server, like Varnish or Squid. You have to `Vary` on the authentication header, and with a counter that increments every request, it invalidates the cache every request. Better is Basic over SSL, since the Authentication header never changes.