2

I would like to understand which would be the best strategy for authentication between two applications running at different places. My application client needs to call the Rest API of a server, and there are only few clients which connect to this server, but the number of request made by the clients are huge. The client is in java stack, and communication occurs over TLS 1.2 .

I have considered the following options

  1. Certificate based Mutual Authentication :- Here both server and client provide their certificate to validate, However, I find this approach to be complicated, though this seems to the best.
  2. Basic Auth :- I find this to be less secure and not recommended.
  3. OAuth :- I don't want to use any other auth provider for tokens.
  4. Pre shared Secret Key : A key is encrypted with timestamp and parameters, and this is passed as a token to validate.

Are there any other approaches which are suitable, and what would be best approach to use.

|improve this question
  • 1
    I think with point nr 3 you mean OAuth, more specifically OAuth 2.0 ? Note that the Authorization Server and the Resource Server can be the same, so you would not necessarily rely on a third party. – S.L. Barth May 16 '18 at 12:25
  • 1
    True, but I think OAuth would be overkill for an application – jones j alapat May 16 '18 at 12:37
1

Basic auth together with some simple bruteforce protection should satisfy you. But if you need more complicated way to manage your app's authentication and authorization, take a look on JWT tokens

|improve this answer
  • I agree Basic Auth is good for me, but not sure whether it is the current Best Practice, Could you clarify more on that aspect. JWT token would be similar to point 4, in that case I'm more in favour of HMAC. – jones j alapat May 17 '18 at 8:55
  • JWT looks good than all others, but why would you consider it complicated, rather I feel JWT would be always better than Basic Auth – jones j alapat May 19 '18 at 11:19
  • @jonesjalapat sorry for my english, flexible, I mean flexible. Basic auth is good for MVP, when you need to do things fast and simple. But when we're talking about authentication inside infrastructure with more than 2 hosts, JWT is very good solution – Максим Романюк May 21 '18 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.