API authentication #275

New issue

Closed

opened 2018-10-09 20:08:46 +00:00 by elegaanz · 1 comment

elegaanz commented

2018-10-09 20:08:46 +00:00

(Migrated from github.com)

Here is how I see it (tell me if you think something is wrong with this design, I'm not used REST APIs):

There is an endpoint in the API for apps to register themselves, it returns a client ID, a client secret
there is another endpoint to get an access token, that requires the client ID, secret and users credentials
this token should be sent in the Authorization header for authenticated API requests
Users can revoke any token from Plume

Plume version (and/or commit): 0.2.0

Currently the API doesn't require authentication. It is not a real problem yet, as the two routes we implemented are read-only, but for routes that will add/change user content, request should be authenticated. Here is how I see it (tell me if you think something is wrong with this design, I'm not used REST APIs): - There is an endpoint in the API for apps to register themselves, it returns a client ID, a client secret - there is another endpoint to get an access token, that requires the client ID, secret and users credentials - this token should be sent in the `Authorization` header for authenticated API requests - Users can revoke any token from Plume Plume version (and/or commit): 0.2.0

trinity-1686a commented

2018-10-10 14:48:36 +00:00

Owner

APIs usually use OAuth authentication. I don't know if there are any crates for it (I saw lots of client-side, but not that much servers-side implementation on crate.io), but I think the best way is probably to use that as it's standard

👍 5

No milestone

No project

No assignees

2 participants

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Plume/Plume#275

No description provided.

Rows
Columns