Home/ Questions/Q 7196671
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-28T20:49:22+00:00

I could do with some help on my REST API. I’m writing a Node.js

  • 0

I could do with some help on my REST API. I’m writing a Node.js app which is using Express, MongoDB and has Backbone.js on the client side. I’ve spent the last two days trying to work out all of this and not having much luck. I’ve already checked out:

I want to keep my backend and frontend as separate as possible so I thought about using a carefully designed REST API would be good. My thinking is that if I ever get round to developing an iPhone app (or something else like that), it could use the API to access data.

BUT, I want this to be secure. A user has logged into my web app and I want to ensure my API is secure. I read about OAuth, OAuth 2.0, OpenID, Hmac, hashes etc… I want to avoid using external logging in (Facebook/Twitter/etc) I want the registering and logging in to be on my app/server.

…but I’m still confused here. Maybe it’s late at night or my brain is just fried, but I could really do with some steps on what to do here. What are the steps for me to create a secure API?

Any help, any information, any examples, steps or anything would be great. Please help!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Here’s a different way of thinking about it:

    Let’s suppose for a moment that you’re not using an API. Your user logs into the app, providing some credentials, and you give a cookie or similar token of some sort to the user, which you use to identify that user has logged in. The user then requests a page containing restricted information (or creating/modifying/deleting it), so you check that this token to ensure that the user is allowed to view that information.

    Now, it sounds to me that the only thing you’re changing here is the way that information is delivered. Instead of delivering the information as rendered HTML, you’re returning the information as JSON and rendering it on the client side. Your AJAX requests to the server will carry that same logged-in token as before, so I suggest just checking that token, and restricting the information down to ‘just what the user is allowed to know’ in the same way.

    Your API is now as secure as your login is – if anyone was to know the token necessary for accessing the api, they would also be logged into the site and have access to all the information anyway. Best bit is, if you’ve already implemented login, you’ve not really had to do any more work.

    The point of systems such as OAuth is to provide this ‘logging in’ method, usually from a third party application and as a developer. This would potentially be a good solution for an iPhone app or similar, but that’s in the future. Nothing wrong with the API accepting more than one authentication method!

    • 0