2

We are in a process to expose some data (not sensitive) via REST APIs. Our API consumer requested the same using only API Key authentication. No Mutual Authentication TLS, no OAuth but plain simple API Key based authentication.

I would like to get some inputs to understand what are the different precautions we should consider to host such APIs as provider.

Consumer have their interface exposed as browser based client (web page) & they would like to call the APIs directly from client side browser app (not from web server). I heard it is existing pattern & if data is not sensitive it can be supported. But I like to make sure that all possible precautions from security perspective has been taken.

  • 1
    an API is just a funny-looking webpage, same rules and considerations apply. – dandavis Mar 18 '18 at 12:41
  • 1
    If the data is not sensitive, why are you authenticating the client at all? Just put it up without authentication, return Access-Control-Allow-Origin: * in response to any CORS request (so web browsers can request the information from arbitrary pages without running into same-origin policy), and call it a day. That is, of course, assuming that the data is truly not sensitive (i.e., completely public, not specific to any user or in any way private). – CBHacking Mar 13 at 21:42
0

I am not sure I fully understand the process your described, because API keys can mean different things, but I don't think I need that info to answer the question. If you got your requests directly from a single page Javascript application, then you cannot be sure whether those requests really came from your consumer's site or from a different site. If you can live with that, then go on, otherwise they will need a server side application and add some sort of secret to the requests there, so you can identify them.

0

Handing out some random string as API key is possible, but this does not allow you to enforce any fine-grained access policies. If you want to prepare for more fine-grained access policies, then you might hand out a signed JSON Web Token (JWT).

From your customer's perspective, a JWT can be simply added to an HTTP header.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.