CODEWITHSUNDEEP
apirestauthenticationsingle-page-applicationrestful-authentication
Robo Robok
Robo Robok

Reputation: 22683

Simple RESTful API authentication

I'm building a single-page web application, fully based on RESTful API. I've seen several topics in that matter, but some things remain unclear for me.

I will need users to log in. Here are some of my ideas:

  1. I can send e-mail and password to API and use basic auth. I'm not sure where should I keep password, should it be encrypted and if so: how?
  2. Can I use built-in session system instead? Is it wrong to use cookies directly in the RESTful API? Why is it so popular to send credentials/keys to API itself instead of using cookies?
  3. I thought about having one API key per user, return it in login action and keep it in localStorage. I guess it's not the greatest idea to have just one key per user?
  4. Then, I came up with idea to have separate keys table and add random keys each time somebody logs in. On logout, the key would go away and no longer be valid. This is more secure than previous idea.

How is it solved in simple projects? I'd like to make it simple but not ridiculously inserure.

Please help.

Upvotes: 1

Views: 3105

Answers (1)

Thierry Templier
Thierry Templier

Reputation: 202156

The commonly approach is to use the header Authorization in REST. The state of the application must be on the client side with REST and shouldn'a be tied to a particularly client kind (browser with cookies)

I think that this link could be helpful:

There is also à great question to à similar question here : https://softwareengineering.stackexchange.com/questions/141019/should-cookies-be-used-in-a-restful-api

Hope it helps, Thierry

Upvotes: 1

Related Questions