Many API's (services) today use OAuth, HTTP Basic Authentication or API keys to authenticate their users.
My goal is to find a simplistic secure way to authenticate users in a client-side webapplication in a stateless way for one service.
Here's my view on some of the authentication methods:
OAuth seems like a great solution, but it looks very complicated to setup and seems overkill for just one service.
According to OWASP "HTTP Basic authentication is not secure and should not be used in applications".
Using plain API keys in a client-side webapplication does not seem like an improvement in comparison to HTTP Basic authentication.
Using encrypted tokens
My alternative idea is to use encrypted tokens which can be verified by the service.
- The token's plaintext will contain the username, password & the expiration date of the token.
The plaintext will be encrypted using a secret key which is only known by the server.
The plaintext will be encrypted on the server using AES in GCM mode, so that the integrity can't be manipulated.
The user needs to login with his/her username and password to receive a token. This token is send on every request and can be verified on the server.
+----------+ +-----------+ | +------ Login with user:pass ---->+ | | Client | | API | | +<---- Send encrypted token ----| | | | | | | +------ Use token to authenticate ---->+ | +----------+ +-----------+
Verification can be done by:
- Decrypt the token using the secret key.
- Verify username and password.
- Check if the token is expired.
Possible pro's of this approach:
- Tokens can be stored in localStorage to mitigate against CSRF attacks and users are able to logout by clearing the localStorage.
- Plaintext login information is not send on every request.
- Tokens can expire.
Possible cons of this approach:
- More load on the server by decrypting every request.
- A token is bound to a specific server.
What do you think is a good solution? Do you know other good alternatives?