Simple Authentication Method to Secure REST API

Question

I've been desperately trying to find a simple method of securing my API but still haven't found one that works. Unlike a lot RESTful APIs my API doesn't need user logins, tokens that expire, or other complex (though very secure) authentication methods, which makes most of the tutorials out there unusable.

The only requirement I have is that a POST request to log a record to my database on one route should be protected while a GET request to access records on that same route should be unprotected. The clients that are logging records are trusted and I would provide their credentials privately.

I've tried using this basic authentication method here:

var basicAuth = require('basic-auth');

var auth = function (req, res, next) {
  function unauthorized(res) {
    res.set('WWW-Authenticate', 'Basic realm=Authorization Required');
    return res.send(401);
  };

  var user = basicAuth(req);

  if (!user || !user.name || !user.pass) {
    return unauthorized(res);
  };

  if (user.name === 'foo' && user.pass === 'bar') {
    return next();
  } else {
    return unauthorized(res);
  };
};

But the POST requests still worked when I used the wrong username and password.

I really don't know what to look for anymore, as I thought basic authentication like that would work.

EDIT: Managed to get this working after changing a couple of things after app.post, which I had overlooked.

Answer 1

If you are not logging the RESTful GET that queries the data in your database and that data is intended to be public, then you can expose an HTTP GET and use the security built into the web server to keep harm from occurring during that operation.

For the RESTful POST, use TLS, the contemporary of SSL, but don't implement it yourself. You can set up an HTTPS POST on any modern web server with ease. Help desk support for installing the server-side certificate is usually supported by the CA. Because people all over the world implement HTTPS POSTs every day, the support for that operation makes it easier to set up and maintain than doing something simple that's actually secure.

What you coded is not secure, which you may not think is important.

To exercise due diligence in answering your question, be warned that giving people credentials over the phone or on a piece of paper is not secure without employing a secure protocol such as HTTPS. Relying on testing the value of a credential on the server leaves a gaping security hole that can lead to consequences you may have overlooked.

Attackers can easily identify the password on route and then wreck havoc on your client/customer/visitor's account and data. Even if the data is not business critical, unprotected writes might end badly. Someone could, for any number of reasons, place child porn or some military secret in your database, which you intend to leave open to the public. You wouldn't be able to prove that you or one of the trusted users didn't put it there.