0

I have an api like /v1/api/data and two clients, client_unrestricted and client_restricted.

The api itself is protected by Oauth. I want to ideally register the clients with the OauthServer so when client_unrestricted makes a requests it gets to see all the data . client_restricted makes a requests it gets to see only subset of the data

Should i ask the OAuth admin to register the clients so the endpoints are like this

client endpoint client_unrestricted /v1/api/data/{data-ids}?restricted=false client_restricted /v1/api/data/{data-ids}?restricted=true Or can OAuth Scopes help me here where i register only one endpoint /v1/api/data but vary the scopes for both the clients ?

client endpoint Scope client_unrestricted /v1/api/data restricted=false client_restricted /v1/api/data restricted=true

1

In Oauth2, you restrict the redirect_uri that can handle the login request the user is sent to after logging in at the authorization server (AS).

So you would register two clients with the OAuth2 admin, each with its own redirect_uri. But this is a defense against someone stealing the authorization code as it is passed from the client to the API.

Restricting the data each client is server, is handled by using scopes, as you suggest. I is usually best to have distinct API resources that serve the different types (restricted/unrestricted) data, and only give the unrestricted client the scope necessary to consume the unrestricted API.

Something like this:

  • /v1/api/basicdata - available with a "basic_data" scope which both clients get.
  • /v1/api/restricteddata - available with a "restricted" scope.
  • How about having only /v1/api/data and the scope being restricted and unrestricted.The Resource Server reads the scope key-value like restricted:True or Restricted:False and makes a decision on what data to be shown ? – jhon.smith Mar 28 '18 at 2:30
  • Sure, in theory that's the same security. I just split the API into two because it's usually easier to maintain the solution with separate endpoints for the two data types. So that part was more of an personal experience note🙂 – Geir Emblemsvag Mar 28 '18 at 7:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.