Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm developing a REST application and I allow my clients to authenticate in several ways (typically using Authorization: Token ... as in OAuth 2.0, but also there's session-based auth option for the web-browsable API). The application allows the client to provide their endpoint to which my application would later POST with some data whenever a particular event happens.

Now I wonder: what's the best way for the client application to authorise that it's my application calling?

Should I roll something up myself (like, include a token derived from the client application secret, which the client app would then verify), or is there a more conventional approach I can follow?

share|improve this question
    
This is addressed in the Oauth 2 RFC. I don't know all the details, but the gist is to use TLS (basically https) and the client can check your certificate to be sure it's you. –  Michael K Mar 4 at 0:14
    
@MichaelK Not sure we're on the same page; this interaction seems to live outside of the scope of OAuth. Assume a client has set up a callback inside my application that asks me to post to https://client_app.example.com/callback_for_myapp. When my app is about to POST there later on, are you suggesting that the client should rely on TLS Client Authentication and call it a day? –  Kos Mar 4 at 15:52
    
Yes. Of course you can create a token-based system if you wanted, but since you need to use https anyway (else your tokens wouldn't be secure) why not use what's already provided? Also, Ouath2 is a flow designed to allow users to authorize clients to have access to their resources on another server. It's not really intended to authenticate the client to the server or vice versa. –  Michael K Mar 4 at 21:51

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.