How to design a RESTful API to check for user's credentials?

rest restapi
wong2 picture wong2 · Apr 13, 2012 · Viewed 17.6k times · Source

I'm designing an API for a mobile app, and I hope to keep it RESTful.
API's are authorized using Basic HTTP Auth, however, When the user open the app for the first time, he need to login first, so I need to design an API to check for user's credentials, which will accept a pair of username and password, return success or fail accordingly.
the problem is what the url should be so it is restful? I don't think /login is a good one.

Answer

Derek W picture Derek W · May 14, 2014

It's typically viewed as poor practice to pass sensitive data via an HTTP GET request.

Password information is sensitive data and is one of the exceptions that breaks the rule that idempotent operations should be GET requests.

Why is this an exception? Browser History and Server Logs will store GET requests. Meaning that this sensitive information is visible as plain text in both places. So if someone gets a hold of either - then that information is now in their hands.

You should use an HTTP POST request to pass this sensitive information to the RESTful API as browsers will not store them and servers will not log them. However, the first line of defense is to use Secure HTTP (HTTPS) to ensure that this information is protected from outsiders.

So pass this information in the body of an HTTP request to an HTTPS URL.

Related questions

What is a good way to transfer binary data to a HTTP REST API service?

We are extending our HTTP REST API to allow clients to upload picture (for the purpose of this question, assuming binary data). So far we have only allowed simply strings in our API parameters. What is a good way to …

Read More
Python post request with Bearer token

Im trying to make a script that post data on REST service together with Bearer token. Here is working PHP example: $postData = array( 'app' => 'aaaa' ); $ch = curl_init($apiUrl); curl_setopt_array($ch, array( CURLOPT_HTTPHEADER, ['Authorization: Bearer '.$…

Read More
Which HTTP response code for "This email is already registered"?

I'm creating a RESTful API for creating users that enforces unique email addresses: Successful POST /users: HTTP 201 Created If I POST the same email address again, what should the response code be? Is 409 Conflict the appropriate response code?

Read More