StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>I think you need to provide more details about your application and how it will be used. There are many ways you can do REST authentication. Some of them are standard, some not. These are just some examples:</p> <ol> <li><a href="http://en.wikipedia.org/wiki/Basic_access_authentication">Basic authentication over SSL</a></li> <li><a href="http://en.wikipedia.org/wiki/Public_key">Digest authentication</a></li> <li>Various kinds of token authentication (<a href="http://en.wikipedia.org/wiki/OAuth#OAuth_2.0">OAuth 2</a>, <a href="http://en.wikipedia.org/wiki/SPNEGO">SPNEGO</a>, various STS)</li> <li><a href="https://en.wikipedia.org/wiki/Hash-based_message_authentication_code">HMAC</a></li> <li>Client SSL Certificates</li> <li>Signed/encrypted cookies. </li> </ol> <p>In case of Amazon S3, they give you "AWS secret access key" when you register. Later your application code needs to know secret key to be able to compute signatures (or it needs to know signed request/url) So ultimately "secret access key" is transmitted over the wire at least once initially during registration.</p> <p>If you use public key cryptography (like client SSL certificates) - you can avoid transmitting private key altogether</p> <ol> <li>you generate public/private key on client</li> <li>Submit public key to the server (or certificate signed by trusted authority)</li> <li>Sign requests(or nonces) with private key and server validates the signature using public key.</li> </ol> <p>If your goal is to just authenticate AJAX requests made to your site after user has authenticated on login page - you can simply use server signed cookies.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload