I want to implement a security mechanism by which i can secure my RestApi from the "Clients who are not what they claim to be". In my case the consumer of API for now is another web service not browser. I have read numerous articles on securing a restApi all they say is to use Bearer tokens,Auth0, JWT. Usually all these technique share a encrypted token/Key whatever it may be , only on login request, On subsequent requests , they will pass the same token in the headers. How can i validate a client if i don't have any login request.
-
Ever think of restrict access by IP address/range? – mootmoot Jul 3 '18 at 14:08
Just give them the token manually. Whether it is JWT, a public/private key pair, shared secret or anything else, you can just give it to all the servers ahead of time manually. I remember once hard-coding the shared secret in PHP code, not that I would recommend that. Still, you should just have a secret, ideally a HMAC key in a file on the requesting server. Then use it to authenticate your request, for example by using JWTs with HMAC.
answered May 4 '18 at 9:57
