Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have server with some resources; until now all these resources were requested through a browser by a human user, and the authentication was made with an username/password method, that generates a cookie with a token (to have the session open for some time).

Right now the system requires that other servers make GET requests to this resource server but they have to authenticate to get them. We have been using a list of authorized IPs but having two authentication methods makes the code more complex.

My questions are:

  • Is there any standard method or pattern to authenticate human users and servers using the same code?

  • If there is not, are the methods I'm using now the right ones or is there a better / more standard way to accomplish what I need?

Thanks in advance for any suggestion.

share|improve this question
up vote 1 down vote accepted

Like @Ryanthal have pointed out, impersonate the server (I'll call it consumer-server) is a good shot. For me the method your are using is common, and I'm going to use a very similar one.

A little flow you can use to impersonate your server is:

  1. The consumer-server post to the login page, the user and password (an account specifically created for that server)
  2. The credentials are validated, and it replies with the authentication cookie (you already do that,for the browsers)
  3. The consumer-server inspect the response and sto re the authentication cookie, in it's session/memory
  4. Consumer-server pass the cookie in the following GETs

For a way of reading/setting the cookie in the consumer-servers take a look here, the cookie is simply a argument passed in the response/request.


  • Unified authentication for both users (browsers) and machines (consumer-servers)
  • If the server changes it's IP, you don't have to wory about
  • Easier to constraint the consumer-server permissions, relying on authorization mechanisms


  • You may have to touch the consumer-servers, it may be off hand if you do not control it
share|improve this answer

Make your servers impersonate users, your authentication system doesn't need to know they are servers or other users, you just need to ensure that authentication never fails for the users that are actually servers.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.