如何在私密和仅限会员的同时建立一个宁静的api？

Question

Back from the Symfony Live 2012 in Paris, where I luckily participate to "Designing HTTP Interfaces and RESTful Web Services" conference, I'v much questions on how to build a RESTful API while keeping it private and member only.

Currently I used to generate an API key to make my API private (I mean available to third-party application on my own but end-users).

To make sure signed up users can use the API (through mobile app) I use Cookie, well, I used SESSION.

But afaik, it is not the correct way to do, according to the talk (and other resources I read over the web).

My needs are the following:

• Provides a private API which only my mobile app can use
• Allows member (of different roles) to do different actions (ie: a Member can post a comment, while an Administrator can edit them all)

As REST constraints are Stateless (amongst others) I can't use Cookie/Session as they need to be initiated by the client and will result in some non-idempotent result.

I read here and there that a way to keep my API RESTful is to provide on each request the credential.

Currently, to authenticate my API key (to keep it private) I use a custom HTTP Authorization scheme, something like Authorization: MyApp SoMeToKeNV3RYPR!V4T3 and then authenticate my member (login) with a POST method (as I would do in any browser web application).

How would you implement such cases? Is it acceptable to use such private scheme and keep using sessions?

After some reading I may think that working with some Signature over each requests can help to solve such problems.

The signature may be generated using the user credential provided in the third-party client while encrypting it with a public/private key (to keep the API private).

On each request, the signature will be checked against a CRC (or something like that) while the credential will be against a database (it doesn't seem worth than checking for a session, does it?)

Any help/advices would be appreciated.

PS: What about OAuth? I don't know much about it, but may it be a solution to such problem?

Answer 1

You're definitely going to want to use OAuth. This will allow you to securely authenticate that your users are who they say they are. No messing with CRCs or anything is needed on your end, once a user is authenticated they have an access token they can use to sign future requests.

You would just need to handle the authentication scheme and handshake and then securely store the access tokens once they have been given out. However, if it were me I would not trust myself to handle all of the secure cases when designing such a system. There are a couple of third party PaaS companies that will do this type of thing for you. I know of the following companies which have some API management tools that will probably help you, and afaik they handle OAuth implementations as well:

• Apigee
• Layer 7
• Ping Identity

If you are so concerned about security though that you don't trust a third party to handle it for you you are going to want to follow the OAuth protocol.