Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would like to build the following project:

  • public REST API back end which can be accessed by any authenticated client.
  • front end with static files in HTML/CSS/Javascript with Backbone.js jQuery calls to the REST back end.

In fact, there are three parties in my architecture : the front end, which is a client of the back end, the back end and the user which wants to authenticate on the front end login page.

What is the best way to secure the three parties involved in this architecture?

In fact, I believe it is just impossible to do a secure app on the front end if I do everything in javascript, so I intend to delegate the authentication/authorization to a proxy layer on my server front end.

My problem is I don't know how to perform this workflow with OAuth :

  • a user wants to create an account on the Front end.
  • the Front end delegate the account creation to the REST back end.
  • the back end create the account and send an ack to the front.
  • then the user can perform calls which require authorization.

And I also want my REST back end be accessible to any other third party application whith OAuth.

Will I have to use 2-legged or 3-legged OAuth on the REST back end?

Can I consider my Front end just like a special third party application which has the ability to create user account ?

What security protocol may I have to use on Front end ?

share|improve this question
1  
Can you focus your question? I think it will help you not only get a better answer, but also make your entire design more solid. –  Yoav Aner Jan 31 '12 at 0:17
2  
This appears to be 4 questions - as @YoavAner said, it may be worth splitting them out or focusing on just one of them. –  Rory Alsop Feb 19 '12 at 10:57
    
Facebook and Twitter have both implemented this sort of thing for their own sites and made them available for other sites and documented all of it. So read up on those before asking such big questions here. –  Major Major Apr 22 '12 at 18:43

1 Answer 1

Well, since you state that the REST API can be accessed only by authenticated clients you will firstly require a form of sessions to remember the authentication state of the client. Depending on whether you can alter the server code of the REST API you could implement this on the API providing server itself.

This could use any of the well known user authentication means like a username/password combination or using a (self-signed) certificate.

However just like with HTTP you will have to make sure that passwords don't travel the line in plaintext and once the session is authenticated the connection should not leak the session identifier allowing for it to be hijacked. This basically means you have to mimic SSL-like behaviour or implement SSL support for your front-end. An example can be found here: http://assl.sullof.com/assl/

Your questions related to OAuth are a different question and I would suggest you ask that in a separate question if it still remains something you want to know.

With regards to a proxy layer, this is a viable option only as long as the API is not publicly accessible other than through such a proxy. This proxy layer would have to implement the same SSL-like properties but this setup gives you the added feature of being able to keep the authentication logic and the API provider separated. However I would not recommend it if you are able to alter the API, because if any part of your server accidentally provides access to the private API you can circumvent your authentication requirements.

share|improve this answer
1  
From my understanding you don't want to ever mimic SSL in Javascript, see matasano.com/articles/javascript-cryptography –  James McMahon Jan 17 '13 at 22:22
    
@JamesMcMahon That's true indeed. The best way to apply SSL-like behaviour is SSL/TLS itself. Anything down form there is a compromise. It would depend on your security needs whether that is acceptable. But 'never', that's a bold statement. For some applications simply the encryption layer is enough (self-signed certificates for example are used in some applications). –  Beanow Jan 18 '13 at 12:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.