REST API Authorization & Authentication (web + mobile)

by

As allways, the best way to protect a key is not to transmit it.

That said, we typically use a scheme, where every “API key” has two parts: A non-secret ID (e.g. 1234) and a secret key (e.g. byte[64]).

  • If you give out an API key, store it (salted and hashed) in you
    service’s database.
  • If you give out user accounts (protected by password), store the
    passwords (salted and hashed) in your service’s database

Now when a consumer first accesses your API, to connect, have him

  • Send a “username” parameter (“john.doe” not secret)
  • Send a “APIkeyID” parameter (“1234”, not secret)

and give him back

  • the salts from your database (In case one of the parameters is wrong,
    just give back some repeatable salt – eg.
    sha1(username+”notverysecret”).
  • The timestamp of the server

The consumer should store the salt for session duration to keep things fast and smooth, and he should calculate and keep the time offset between client and server.

The consumer should now calculate the salted hashes of API key and password. This way the consumer has the exact same hashes for password and API key, as what is stored in your database, but without anything seceret ever going over the wire.

Now when a consumer subseqently accesses your API, to do real work, have him

  • Send a “username” parameter (“john.doe” not secret)
  • Send a “APIkeyID” parameter (“1234”, not secret)
  • Send a “RequestSalt” parameter (byte[64], random, not secret)
  • Send a “RequestTimestamp” parameter (calculated from client time and known offset)
  • Send a “RequestToken” parameter (hash(passwordhash+request_salt+request_timestamp+apikeyhash))

The server should not accept timestamps more than say 2 seconds in the past, to make this safe against a replay attack.

The server can now calculate the same hash(passwordhash+request_salt+request_timestamp+apikeyhash) as the client, and be sure, that

  • the client knows the API key,
  • the client knows the correct password

More Related Contents:

  1. How to implement authorization using a Telegram API?
  2. How to build a RESTful API?
  3. How do I restrict JSON access?
  4. Undefined index $_POST
  5. How do I make a request using HTTP basic authentication with PHP curl?
  6. How to POST JSON Data With PHP cURL?
  7. HTTP authentication logout via PHP
  8. How to post JSON to PHP with curl
  9. REST API – why use PUT DELETE POST GET?
  10. PHP login system: Remember Me (persistent cookie) [duplicate]
  11. Can you get a Windows (AD) username in PHP?
  12. Cannot connect to MySQL 4.1+ using old authentication
  13. Redirecting to previous page after login? PHP
  14. How to write a REST API?
  15. Twitter API returns error 215, Bad Authentication Data
  16. Why does the Laravel API return a 419 status code on POST and PUT methods?
  17. How to set UTF-8 encoding for a PHP file
  18. Why I can not login to magento backend using google chrome
  19. How to enable and use HTTP PUT and DELETE with Apache2 and PHP?
  20. PHP multipart form data PUT request?
  21. Google_Service_Directory – (403) Not Authorized to access this resource/api
  22. Authenticating in PHP using LDAP through Active Directory
  23. PHP cURL HTTP PUT
  24. Authorization header missing in PHP POST request
  25. Password_Hash not working on my PHP login
  26. PHP best practices for user authentication and password security
  27. Login only if user is active using Laravel
  28. PHP form token usage and handling
  29. Using windows authentication with php?
  30. Using Clean URLs in RESTful API

Leave a Comment