Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I am creating a simple web API that returns JSON.
It will perform simple crud operations.
What is the best way to authenticate users, OAuth seems to be the main recommendation here but I’m looking for something I can implement myself simply, token based or and API key?
Any ideas suggestions tips would be great.
UPDATE: Forgot to mention, this API wont be for general consumption, its just for my own use but I want to make sure someone can’t get in too easily if they stumble on it.
First of all in order to build a good API you should use other people’s API to see how they work. To be RESTful an API key is used, which is just a really big random number or “cryptographic nonce”. But really this is just like immortal session id to look up a users authentication information, which isn’t that great. OAuth is great, if you want your own system kerberos is very secure.
It is possible to hijack json responses, which is a pitfall against json. If the API key is required for each request, then the attacker can’t use this method.