I want to implement a security mechanism by which i can secure my RestApi from the "Clients who are not what they claim to be". In my case the consumer of API for now is another web service not browser. I have read numerous articles on securing a restApi all they say is to use Bearer tokens,Auth0, JWT. Usually all these technique share a encrypted token/Key whatever it may be , only on login request, On subsequent requests , they will pass the same token in the headers. How can i validate a client if i don't have any login request.

  • Ever think of restrict access by IP address/range? – mootmoot Jul 3 '18 at 14:08

Just give them the token manually. Whether it is JWT, a public/private key pair, shared secret or anything else, you can just give it to all the servers ahead of time manually. I remember once hard-coding the shared secret in PHP code, not that I would recommend that. Still, you should just have a secret, ideally a HMAC key in a file on the requesting server. Then use it to authenticate your request, for example by using JWTs with HMAC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.