Tag Info

Hot answers tagged

2

I think RFC 2616 is quite clear: 10.4.4 403 Forbidden The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the ...


1

What you basically need to do is: Verify that a request is coming from an authenticated user, i.e. a user (or service) that's allowed to use your API; and Ensure a request isn't altered while in transit, commonly known as a Man-in-the-middle attack. You could install X.509 certificates on each publisher's web site and use this to authenticate them over a ...



Only top voted, non community-wiki answers of a minimum length are eligible