How to implement user authentication in a RESTful style?

Question

I am learning RESTful and have come up with such a question:

Since RESTful web services requires that the server side does not store any connection data, how do we implement user login?

The traditional method can use server-side session to store user data, but RESTful gets aways from it.

One apparent solution is that, the user side always sends username and password every time they visit a new page, and the server side always authenticates the user before it does everything. However, this approach seems very ugly as the front-end has to store username/password and send them in every link, and the server has to check against the database to authenticate, which seems too slow.

So how do we even implement any user authentication mechanism without storing any tracking information on the server side?

You can create something like ApiKey model. Which can generate access tokens. Then you would look for ApiKey by access user token you previously generated. You may also want to add additional restrictions to ApiKey like expires_in etc. So before each request if you don't find the ApiKey by using access token you can return head :unauthorized from your controller method. Additionally check this out railscasts.com/episodes/352-securing-an-api — ant
– ant, Commented Oct 27, 2014 at 4:14

Pete · Accepted Answer · 2014-10-27 04:37:28Z

1

A good RESTful way to implement authentication is through Tokens. E.g a unique and hard to guess collection of characters that only the authenticated user and server know or can deduce.

RESTful Approach

For the sake of simplicity I'm assuming it's a JSON based web service, though the approach would be the same with XML or any other data structure:

POST /tokens
BODY:
{"username": "my_user_name", "password": "thepassw0rd"}

A successful validation would return a 200 OK response with a new unique token for the user:

200 OK
RESPONSE:
{token: 'wVXBbpBP4EnjpgENLUp7'}

Then instead of sending the username/password with each RESTful request the token is sent via a HTTP header:

GET /some_resource
HEADERS:
X-Auth-Token: wVXBbpBP4EnjpgENLUp7

If the token is invalid (fake, expired etc), a 401 Unauthorized HTTP status can be returned. This has the advantage that authentication doesn't interfere with the structure of your RESTful responses.

Storage

It is possible to generate a token that doesn't require storage. One way is by having the Token an encrypted string of the user id, similar to how Ruby on Rails encrypts session data client-side in a cookie. However this has some disadvantages, namely it becomes harder to revoke tokens, set expirations on the token or have levels of authorization. Unless your service is immediately going to have Google-sized amounts of traffic, you'll have more flexibility if you store each token on the server.

answered Oct 27, 2014 at 4:37

Pete

2,2461 gold badge18 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

OneZero Over a year ago

So we still need some kind of server-side storage even with RESTful?

Pete Over a year ago

Just to clarify, are you talking about when using a third-party RESTful web service or building your own RESTful API?

OneZero Over a year ago

I'm saying building my own. I'm trying to understand what's the best practice instead of just using something that has been built already.

Pete Over a year ago

You will always need to have some kind of server-side storage when you're doing your own authentication. At the very least you will need to store each user's username and hashed password. While it's technically possible to not store each token on the server, there are some security and flexibility considerations to keep in mind that I mentioned above. Authentication tokens are considered best practice and are fundamental to protocols like OAuth

Collectives™ on Stack Overflow

How to implement user authentication in a RESTful style?

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related