REST API Authentication

I'm building an application which will be hosted on a server. I want to build an API for the application to facilitate interaction with from any platform (Web App, Mobile App). What I'm not understanding is that when using the REST API, how do we authenticate the user.

For example, when a user has logged in and then wants to create a forum topic. How will I know that the user is already logged in?

Solution 1:

For e.g. when a user has login.Now lets say the user want to create a forum topic, How will I know that the user is already logged in?

Think about it - there must be some handshake that tells your "Create Forum" API that this current request is from an authenticated user. Since REST APIs are typically stateless, the state must be persisted somewhere. Your client consuming the REST APIs is responsible for maintaining that state. Usually, it is in the form of some token that gets passed around since the time the user was logged in. If the token is good, your request is good.

Check how Amazon AWS does authentications. That's a perfect example of "passing the buck" around from one API to another.

*I thought of adding some practical response to my previous answer. Try Apache Shiro (or any authentication/authorization library). Bottom line, try and avoid custom coding. Once you have integrated your favorite library (I use Apache Shiro, btw) you can then do the following:

1. Create a Login/logout API like: /api/v1/login and api/v1/logout
2. In these Login and Logout APIs, perform the authentication with your user store
3. The outcome is a token (usually, JSESSIONID) that is sent back to the client (web, mobile, whatever)
4. From this point onwards, all subsequent calls made by your client will include this token
5. Let's say your next call is made to an API called /api/v1/findUser
6. The first thing this API code will do is to check for the token ("is this user authenticated?")
7. If the answer comes back as NO, then you throw a HTTP 401 Status back at the client. Let them handle it.
8. If the answer is YES, then proceed to return the requested User

That's all. Hope this helps.

Solution 2:

You can use HTTP Basic or Digest Authentication. You can securely authenticate users using SSL on the top of it, however, it slows down the API a little bit.

• Basic authentication - uses Base64 encoding on username and password
• Digest authentication - hashes the username and password before sending them over the network.

OAuth is the best it can get. The advantages oAuth gives is a revokable or expirable token. Refer following on how to implement: Working Link from comments: https://www.ida.liu.se/~TDP024/labs/hmacarticle.pdf