RESTful API Authentication

api rest restful-authentication
Obto picture Obto · Sep 30, 2011 · Viewed 18k times · Source

I have found quite a few questions on this topic on SO, but couldn't find any answering this question:

Should I validate users with their username and password, or with an API key? And what are the pros and cons of each method.

I ask this because in my API, there are a couple of methods I'd like to lock down and verify that the user has access to some document or action. I'm a bit reluctant to authenticate by having the user send an HTTP AUTH header with their username and password because it feels unsecured and a bit more of a hassle for the user. On the other hand, though, if I use an API key, what's the point of the user ever creating a password? As they will no longer be using it to access features of the API.

UPDATE

If other readers of this are curious what I ended up using, I decided to copy how Amazon does their validation (good explanation here: https://www.ida.liu.se/~TDP024/labs/hmacarticle.pdf)

Answer

Muhammad Hasan Khan picture Muhammad Hasan Khan · Sep 30, 2011

you can use HTTP Authentication over SSL and that's secure enough. However it makes consumption of API a bit difficult as it requires the client library to support SSL. SSL can affect the performance too if you're expecting too many calls simultaneously.

API key option is just as insecure as HTTP Authentication without SSL. If you're not concerned with security then API Key is the easiest for consumers of the API.

Related questions

Best way to secure Private REST API without user authentication for mobile app

I am making some Restful APIs for my mobile application. The communication between APP and webserver has to be made in REST. These apis should be private , and only my app should able to call them for successful results. The …

Read More
RESTful user authentication service

Hey folks, this seems to have been discussion fairly often but I want to make a simple, watered down question around doing authentication with RESTful services. The scenario is as follows: There is a system that houses registered users for …

Read More
How do you prevent brute force attacks on RESTful data services

I'm about to implement an RESTful API to our website (based on WCF data services, but that probably does not matter). All data offered via this API belongs to certain users of my server, so I need to make sure …

Read More