Alex Rivera | Logout

how can I authenticate a user from a web app to an API?

Asked 2010-12-17T21:45:52.313
12

It seems to be a widely asked questions and after having read tons of documentations on the subject, I'm still not sure to have understood everything correctly (I assume that being dumb is a possible answer ;)).

I'm trying to build an API that will provide a service to users. The users will be connected through Facebook or any OpenId provider (I separate Facebook since their implement their own connecting system).

(I think it's a good way because I will not store the user's password and finally will have less problem in case of a similar Gawker issue.)

When a request is made from the client (web app, mobile app, whatever) to the API, an indicator must be sent with the request in order to identify which user is using the app. This is generally used via a token, defined during the Authentication.

But regarding the Authentication, I can't find any valuable example, tutorial, explanations about how to implement it correctly.

I'll (try to) explain :

In my (wonderful world of happy care bears), I structured my project in various parts :

  • A RESTful API
  • A web apps that will use the api. Ideally, I was thinking about making a complete html/css/js project, without any server side work (php/python/java or whatever)
  • A mobile application
  • An windows/mac/linux application

As far as I saw, every time someone ask how to implement a RESTful API authentication, three major answers pops out :

  • The HTTP basic( + preferably SSL)/digest way
  • OAuth
  • OpenId

Since I will not store the user's password, the first one is out for me, but the two other leave me perplex.

But OAuth and OpenId are not the sames, one (OpenId) stand for the Authentication (that the base of the questions) where the second (OAuth) stand for the Authorization!

authentication rest openid
Edit
Report

1 Answer

2

You don't really want to login to the API using OpenID. As you said, OpenID is for Authentication, i.e. Who, while OAuth is for Authorization, i.e. am I allowed? But your structure suggest you'll be using an API as a backend and a web app as a front-end.

The best way then is to use OpenID on the web-app to authenticate the user, and then the web-app connects to the API and stores the OpenID credentials. The web-app then knows who the user is, and can provide the service. The API has nothing to do with the user, except that it stores its data.

The fundamental difference between OpenID and OAuth is its use. In your situation, you could have something like that:

--------          ---------            -------
| User | <------> |  App  | <--------> | API |
--------  OpenID  ---------   (OAuth)  -------

The User never interacts directly with the API: who would want to manually send HTTP request? (lol) Instead, the service is provided through the app, which can optionally be authorized using OAuth. However, in the case of a single app accessing the API, you can make the app <=> API connection internal and never expose it.

answered 2010-12-19T03:39:43.890

Your Answer