1
vote
1answer
56 views

Is OAuth suitable for this scenario?

I need to create a simple web application for track expenses, with some basic actions (user must be able to create an account and log in, list expenses, edit them, etc) with a REST API for each one, ...
1
vote
0answers
91 views

ASP.NET MVC WebService - Security for Industrial Android Clients [closed]

I'm trying to design a system that will allow a bunch of Android devices to securely log into an ASP.NET MVC REST Web service. At present neither side are implemented. However there is an ASP.NET ...
0
votes
0answers
55 views

How to have my callbacks authenticated in a REST app?

I'm developing a REST application and I allow my clients to authenticate in several ways (typically using Authorization: Token ... as in OAuth 2.0, but also there's session-based auth option for the ...
1
vote
1answer
198 views

What kind of user authentication do I need in for a restful web api

I am doing a restful web api with asp.net Web API 2 I do not want to use any form of cookies or basic authentication (send user/pass in cleartext thus SSL needed) I do not use/need claims stuff. I ...
1
vote
1answer
289 views

Is it an implementation of a stateful mechanism for Rest API authentication?

In many articles about Rest API's best practices, it is recommended to not depend upon sessions on server side since it leads to a stateful mechanism. I currently use Play 2.2 framework, with a ...
4
votes
1answer
2k views

Authenticate native mobile app using a REST API

I'm starting a new project soon, which is targeting mobile application for all major mobile platforms (iOS, Android, Windows). It will be a client-server architecture. The app is both informational ...
0
votes
0answers
260 views

Is this a secure solution for RESTful authentication?

I need to quickly implement a RESTful authentication system for my JavaScript application to use. I think I understand how it should work, but I just want to double check. Here's what I'm thinking -- ...
18
votes
4answers
2k views

How should I architect a RESTful webservice to use 3rd party (i.e. Google, Facebook, Twitter) for authentication?

For my job we have a nice RESTful webservice we've built out that we use to drive a couple websites we have. Basically the webservice lets you create and work with support tickets, and the website is ...
8
votes
2answers
537 views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
2
votes
1answer
2k views

Custom use of Authorization header in a REST API

I'm building a REST api where clients are authenticated using client certificates. A client in this case is not an individual user, but some sort of a presentation layer. Users are authenticated using ...
8
votes
7answers
1k views

Will Authentication over HTTPS Slow My Application?

I am building a web application and RESTful web service. I have been reading various articles about the best way to authenticate the requests to the web service. The best option for me seems to be ...
4
votes
2answers
360 views

Standard -server to server- and -browser to server- authentication method

I have server with some resources; until now all these resources were requested through a browser by a human user, and the authentication was made with an username/password method, that generates a ...
12
votes
2answers
6k views

How should an API use http basic authentication

When an API requires that a client authenticates to it, i've seen two different scenarios used and I am wondering which case I should use for my situation. Example 1. An API is offered by a company ...
5
votes
1answer
615 views

API Auth vs User Auth

I have read many posts and articles on this topic but still cant connect the dots. I want to make a Rails app that is strictly a JSON API maybe using Sinatra or the rails-api gem. I also want to make ...
3
votes
4answers
7k views

REST Service Authentication/Authorization

I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them. Is ...
10
votes
4answers
647 views

Am I Over-Engineering If I Consider User's Intentional Wrongdoing?

Is it over-engineering if I add protection against a user's intentional wrongdoing (to put it mildly), if the harm the user can incur is not related to my code? To clarify, I'm exposing a simple JSON ...
6
votes
2answers
3k views

Designing authentication for REST API

I'm working up an API for a REST service that I'm going to both be producing and consuming. I've spent the past few days trying to figure out how to handle authentication nicely, and think I've ...