5

Suppose I develop a social networking site and I decide that I want the core of the application to be completely REST'ed. A user logs in with a password. Now, my question is does every request require password and login pairs (assuming that you need to provide your identity) at the end of URL like www.site.com/index.php?p=pass&l=login? I would be a little nervous about asking for that at every request. I know that I am missing something… it can't be like that because anyone could snoop into packets and capture the password and login easily. I don't think having all requests done in HTTPS would make sense (I read it's taxing on resources).

So please fill in the missing part that I need to understand.

2
  • 2
    Investigate request signing, Oauth and/or other token-based authentication mechanisms. I don't have the time to write this up as a complete answer, but this should give you something to search for.
    – deceze
    Jan 29, 2012 at 1:53
  • thanks - will definitely read more about them
    – netrox
    Jan 29, 2012 at 4:22

3 Answers 3

12

First off, unless you know that using SSL is too expensive for you, use SSL. Security comes before performance optimizations.

Now, about passing usernames and passwords: usually you have an "API access token" or the like. It's not actually the username/password, but when someone has it they're granted the ability to make API requests. These can have limited or unlimited validity as you like. You can even make the token a signature - the user signs the request with some key, and you validate the signature.

But yes, since each API request is independent of the last, you're going to either have to use HTTP Basic authentication or its equivalent, or pass the API token (or other signatory device) with every request.

1
  • 1
    +1 for security before performance. Those saved cycles won't be worth anything when you spend a week in disaster recovery!
    – jprofitt
    Jan 29, 2012 at 2:00
6

Typically, you make a call to a login method that will generate a token that can be reused in all the next requests.

My advice is to force the use of SSL on every request, if that is not possible you should probably request a secure login and generate a temporary token for that particular session (similarly to session IDs).

You can see how OAuth is being used by the Flickr API to provide authentication in the diagram below. In this scenario, a temporary token is used to ask for a permanent token and a token secret.

OAuth Flickr diagram

Taken from: http://www.flickr.com/services/api/auth.oauth.html#access_token

1

Traditional session tracking rules apply to REST just like any other system. Your best bet is to do a login up front, then return to the client a token which they then pass to you on every request (be it in query string, a cookie, or what have you). The token indexes into some server-site datastore that contains all the appropriate session information -- and specifically the user's identity etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.