How to do authentication within a HTTP service?

Question

We currently have a website that has user account functionality, but we are looking to provide an API to allow users to manage their accounts/perform actions via other devices/websites, by providing an API for common tasks.

Currently the website login is done via HTTPS for security, and then managed using PHP sessions with suitable security measures to guard against session hijacking etc.

How would we provide this functionality in an API?

How is it possible to submit a login without doing a POST? (As presumably GET is the only way to do this via an API call). Is isuing a URL like: https://www.example.com/login/user-foo@password=bar secure? Does the https setup happen before the URL is sent over the wire?

If I can sort that out then I would have the login return an access token. The first request should include this token, and the response should return a new token, for use on the second request and so on....

Would this work?

Answer 1

The URL is sent like any other header to the web-server. So it's no problem to send it like that. The only problem I can see with it is that it might appear in web-server logs or other logs. So POST might be better to use. The only reason I can see to not use POST is that it might be a little bit harder to use the API.

Answer 2

Have you thought about using SOAP over SSL? In theory, you should be able to authenticate an user over SOAP.

Answer 3

Use a standard, such as OAuth? If you allow for that, then your user can keep the authenticated token as long as they wish.

Alternatively, you may not need any authentication at all, if you could redirect to a login when some GET request comes in. For example: any site can link to an URL to add a tweet to Twitter. When not signed in, Twitter will first redirect to the login page. The referring site does not even need to know the Twitter username.

(And yes: HTTPS is established, based on the IP address of the server, before the URL is sent.)

Answer 4

You can use basic www-authentication. It's basically a header, which contains username+password. The good thing about this, is that it's stateless (you don't need a separate login process), and it's very well supported. It's also quite simple to implement. As long as you serve it over https, the security is fine.

Is isuing a URL like: https://www.example.com/login/user-foo@password=bar secure?

It's not good to put the credentials in the URL, since it might end up in a log.

Does the https setup happen before the URL is sent over the wire?

Yes, https is established before the http protocol. The only thing a malicious person would be able to see, is the IP addresses of the endpoints.

Answer 5

You can perform authentication in a REST API by requiring a header to be set by the caller. i.e. They set an "X-YourApp-API-Key" header that you then read and use to authenticate. This allows you to authenticate not just POST and GET methods, but PUT, HEAD, and DELETE so you have the full complement of REST methods.

This by itself is fine if all of your calls are via HTTPS. If you want to authenticate over HTTPS and then have subsequent calls via regular HTTP you need to implement something that works like OAuth and issues a token for the in-the-clear requests.