2

I created a large backend+frontend project for a client. They recently started a different project, and contracted an other company to develop and host it. Since they need some of the data from my project, they asked me to develop an api, so they can access the required data.

I created a rest api, where the client is authenticated with an api key. This api key is sent in each api request in a http header, named X-MY-AUTH-CODE. Since the api is only available over https, as far as I know an attacker is not able to eavesdrop the communication, and access the api key.

Some folks recommended me to use OAuth 2 for this task, but I don't understand, what would I benefit from it:

  • The users don't have to consent to anything
  • It is purely a server to server communication
  • The OpenApi tokens are also sent in an Authorization: Bearer http header, which as I see is just as secure as sending api keys

How could a server to server rest api communication be more secure or straightforward, by using OAuth 2?

Improve this question
1
  • Is the request going to be from a server in somecompany.com domain to yourawesomecompany.com ? How are you planning to maintain the authorization pieces once the projects are handed over?
    – Limit
    Feb 3, 2021 at 6:47

2 Answers 2

Reset to default
1

There can be multiple reasons for this depending on how the services are generally deployed in the organization/system and what is the typical authentication mechanism. It would be weird to use a different authentication mechanism just for one service.

If one had to make a blanket statement, then I think the advantage is in terms of token expiration. The API keys have no expiration date while the OAuth tokens generally do. This way, even if some rogue server in your system was able to grab your OAuth token, there will be a limited amount of time till they are able to authenticate.

Improve this answer
1
  • 1
    Additionally, the credentials for the OAuth client are only exposed rarely and only to the authorization server. Furthermore, creating tokens that only authorize the user to consume specific endpoints, or handle specific objects is easier when the token is an JWT (that may be granted through OAuth) instead of an API key.
    – BenjaminH
    Feb 3, 2021 at 14:15
-2

The benefit of using OAuth is that it is an industry standard which has been peer-reviewed. Your home grown system is not necessarily less secure, but I'm willing to bet that it hasn't been pentested/peer reviewed. What would make OAuth2 more straightforward is the fact that other developers likely have experience working with OAuth2 in the past, and there is tooling available for working with it.

Improve this answer
1
  • Except these are very different authentication methods with (potentially) very different purposes. Given the very large differences between these methods, the fact that OAuth2 is peer reviewed and the OPs method isn't is hardly even worth a mention.
    – Conor Mancone
    Feb 2, 2021 at 17:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .