What I expect for my authentication/(authorization) mechanism is three things:
- Preventing all known malicious ways of stealing or acting on user's data: CSRF, XSS etc..
- Encrypting all the messages exchanged.
I'm not expert in security but I read some good articles about a guideline to follow:
- Avoid an authentication way based ONLY on cookie mechanism, as this article well explains.
- HTTPS is not enough, yet it is really really advise to ensure at least messages encryption.
Of course, I agree with those principles but...I'm confused about the number of similar ways to achieve a good authentication mechanism:
What is the difference between the article I put in link just above and the OAuth 2.0 Resource Owner Password Credentials Flow?
Indeed, both use those steps: exchanging username and password for an access token that is itself sent along the user's navigation using the HTTP Authorization Header.
What additional security aspect does this OAuth 2.0 workflow bring compared to the cookie-based token solution?
Does the solution of cookie-based token as presented in the article is really enough to secure my infrastructure? As the author claims..
I came across this another great solution, that I judge also similar to others, excepted that it doesn't really need https since based on shared secret key: HMAC mechanism.
What would a security expert advise me? I don't exchange really sensitive data like money accounts etc.. but enough data to annoy users if something unexpected happens..
I would be happy to be more clear (in comments), but I hope I am.
I came across so many forums, articles, videos, etc... but I'm still confused about those different ways of achieving the thing.