API authentication #275

Uusi ongelma

Suljettu

opened 2018-10-09 20:08:46 +00:00 by elegaanz · 1 kommentti

elegaanz kommentoi

2018-10-09 20:08:46 +00:00

(Migrated from github.com)

Here is how I see it (tell me if you think something is wrong with this design, I'm not used REST APIs):

There is an endpoint in the API for apps to register themselves, it returns a client ID, a client secret
there is another endpoint to get an access token, that requires the client ID, secret and users credentials
this token should be sent in the Authorization header for authenticated API requests
Users can revoke any token from Plume

Plume version (and/or commit): 0.2.0

Currently the API doesn't require authentication. It is not a real problem yet, as the two routes we implemented are read-only, but for routes that will add/change user content, request should be authenticated. Here is how I see it (tell me if you think something is wrong with this design, I'm not used REST APIs): - There is an endpoint in the API for apps to register themselves, it returns a client ID, a client secret - there is another endpoint to get an access token, that requires the client ID, secret and users credentials - this token should be sent in the `Authorization` header for authenticated API requests - Users can revoke any token from Plume Plume version (and/or commit): 0.2.0

trinity-1686a kommentoi

2018-10-10 14:48:36 +00:00

Omistaja

APIs usually use OAuth authentication. I don't know if there are any crates for it (I saw lots of client-side, but not that much servers-side implementation on crate.io), but I think the best way is probably to use that as it's standard

👍 5

Kirjaudu sisään liittyäksesi keskusteluun.

Ei merkkipaalua

Ei projektia

Ei käsittelijää

2 osallistujaa

Ilmoitukset

Määräpäivä

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

Määräpäivää ei ole asetettu.

Riippuvuudet

Riippuvuuksia ei asetettu.

Viittaus: Plume/Plume#275

Ei kuvausta.

Rivit
Sarakkeet