CODEWITHSUNDEEP
javascriptsecurityrest
Leah Sapan
Leah Sapan

Reputation: 3801

How to make a web API private

I have an API that I would like to restrict access to. I can provide access keys and check them with each request, but I'm not sure how far this is really going to go.

The API is used by applications, but it is also used by a web app which someone can just view the source of. If they did, they would have the key and could easily make API calls.

Is there a more reliable way to secure access? I'm not sure what the standard practice here is.

Edit: After thinking about it, I could use a two-prong approach. The web app can use POST with CSRF, and applications can use API keys. Any other ideas, or is this a generally accepted solution? (Note, this still wouldn't work for third-party web apps.)

Upvotes: 0

Views: 2130

Answers (2)

Lloyd Banks
Lloyd Banks

Reputation: 36689

Your API is never private since it's used by a web app which I am assuming is available to the general public. If this is the case, there really is no impetus to secure it since anyone and everyone would have access to the API.

If on the other hand, this web app is only available to registered users, you can use a token system to check for authorization. When the user successfully logs in, you pass back a token (usually something 20 to 30 characters long). Every API request would require a valid token. Tokens can be set to expire automatically (using a database job) X hours after creation if your application requires higher security thresholds. If security isn't a big issue, they can be renewed automatically every time a request is made.

This is essentially a two tiered approach. Temporary tokens are generated for users to directly connect to your API so that permanent credentials are never sent to the client. Predefined keys are given to third party developers who build applications on top of your API and have their own back-end.

Upvotes: 2

Alexander C.
Alexander C.

Reputation: 93

If it's your API you can simply do this.

1) Insert the following code into your API file(s)

$authToken = "APItoken"; //variables


if( !isset($_REQUEST["authToken"]) || $_REQUEST["authToken"] != $authToken )
 die("Need auth token");

2) You will now need to GET/POST/PUT the URL like this: http://www.yoursite.com/api1.php?authToken=APItoken&nextParam=&paramAfterThat=

If this helped please mark it as the answer

EDIT:

Nevermind, read it wrong. Updating answer in a few minutes.

Upvotes: 0

Related Questions