5 ms·
>> You have an “API/Key/Token” in a header or a url. This - specifically, how to do user authentication/access control in a RESTful manner - has always puzzled
by JimmyL 17y ago
>> You have an “API/Key/Token” in a header or a url.
This - specifically, how to do user authentication/access control in a RESTful manner - has always puzzled me. The author suggests HTTP Digest authentication, but that seems to fly in the face Roy Fielding's commandment that a RESTful interface shouldn't depend on the communications protocol being used; HTTP Digest seems pretty tightly coupled to HTTP, no?
Broadly, what are some of the canonical ways to do user authentication while still keeping close to the theoretical/theological underpinnings of REST?
- kqr2 17y agoThis is an interesting blog post on http authentication woes: http://www.artima.com/weblogs/viewpost.jsp?thread=155252 http://www.artima.com/weblogs/viewpost.jsp?thread=155252
- psadauskas 17y agoEvery single one of these concerns can be solved wuth digest auth over javascript: http://www.peej.co.uk/articles/http-auth-with-html-forms.html http://www.peej.co.uk/articles/http-auth-with-html-forms.htm... and http://www.berenddeboer.net/rest/authentication.html http://www.berenddeboer.net/rest/authentication.html
- alexandros 17y agoRESTful interfaces should NOT be ptotocol independent. While REST can be implemented over multiple protocols, a RESTful interface is by definition tightly coupled to the protocol it goes through. For instance REST specifies that we should use a uniform interface, but HTTP tells us what that interface is, and a REST over HTTP interface (the most common RESTful interface) has to respect that. I would be interested in where you read this fielding quote as this 'protocol inependence' and its problems is a common charge he makes agains WS-* if anything.
- JimmyL 17y agohttp://roy.gbiv.com/untangled/2008/rest-apis-must-be-hypertext-driven http://roy.gbiv.com/untangled/2008/rest-apis-must-be-hyperte... Specifically: A REST API should not be dependent on any single communication protocol, though its successful mapping to a given protocol may be dependent on the availability of metadata, choice of methods, etc. In general, any protocol element that uses a URI for identification must allow any URI scheme to be used for the sake of that identification. [Failure here implies that identification is not separated from interaction.]
- alexandros 17y agoWell, Roy has a way of describing things from a Systems Engineering perspective. that can confuse when read from people with a different context. I think where HTTP digest etc. comes in is the 'successful mapping' bit. While the abstract API should not specify HTTP digest, the materialised API that people actually use (the mapping of the API onto HTTP) should.
- bkudria 17y agoAmazon has clients sign the request: http://docs.amazonwebservices.com/AmazonS3/2006-03-01/RESTAuthentication.html http://docs.amazonwebservices.com/AmazonS3/2006-03-01/RESTAu...