Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I own a REST API at server side and a distinct web application that would call those APIs.

I want to secure my APIs calls.

After some reading, I want to implement the OAuth 1.0a mechanism at server side. Indeed, dealing with temporary tokens, nonces etc.. is by far more secure than a traditional HTTP basic solution that depend strongly on the SSL encryption.

However, in most of examples I found on the web, OAuth seems to be by essence a means to access some data from a resource owner (like Facebook, Twitter etc...) without the need for the user to transmit its corresponding credentials to my own app.

My question is: Does it make sense to implement OAuth if my actors are just my own web application and my own set of API's at server side, (meaning no external data provided by a 3rd party are involved)? Indeed, I really want to benefit of its algorithm.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

While it isn't necessary to have the complexity of OAuth when authenticating against your own system (because you can share your actual user account data) if you want to provide that level of isolation to the user server, then using OAuth does still afford you advantages. At that point you would simply be implementing a stand alone OAuth provider which your various services could use as a single sign on across your system.

You could also then allow users to use their profile as a single sign on for other services if you so desired by making the OAuth account usable by other sites.

share|improve this answer
    
Yes, OAuth might be a heavy solution for my case, but I didn't find a standard way other than OAuth1.0a using a mechanism dealing with API keys rather than standard passwords through HTTPS. Even Amazon S3, that provides a great and interesting mechanism (through HMAC-SHA1 algorithm) is not a standard solution for most of developers. As I'm not an expert in security, I want to trust a fully known and tested mechanism, like Oauth so. –  Mik378 Feb 14 at 14:38
    
The other nice thing about OAuth is you can use an existing OAuth provider potentially. There are actually pre-written OAuth account servers you could use so that you don't have to write your own. –  AJ Henderson Feb 14 at 14:41
    
Yes, I found some companies like StormPath that provides some security features for any app while paying :) I will start to try to implement my own provider. I'm currently searching for a library that could help based on Java or Scala. –  Mik378 Feb 14 at 14:43
    
You may also want to look in to OpenID. It's a bit limited, but it could work as a base starting point for you. I use that for my personal OAuth server. –  AJ Henderson Feb 14 at 14:45
    
Yes, why not, I have to study the case deeper. And you use an already-written library to build your solution? –  Mik378 Feb 14 at 14:49
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.