2

I have developed a REST/JSON API. The API exposes a lot of features. The API will be consumed by applications we design internally (mobile apps and web apps), by applications designed by our resellers and by applications designed by businesses. I am looking at securing the application by implementing authentication and authorization. I have 'googled' a lot but my research has left me with more questions than answers.

  1. Our internal application will be used by end users registered on the application. In essence, our application is just a client taking request from the end user, taking it to the REST API and retrieving the data for the end user. Our internal application should be able to perform all the operations exposed by the REST API. What is the best way to handle user login on our internal application? HTTP Basic over SSL or OAuth?

  2. Our reseller applications can create users like they own the users but ultimately the user details get stored in our database. The reseller application will just act as a client taking request from the user and fetching user data. Our resellers applications should only be restricted to some operations of the REST API. What security mechanism will I use to implement this kind of authorization and user login?

I hope my question is clear. Thanks for the help.

Improve this question

1 Answer 1

Reset to default
1

Assuming your application is a web application, then OAuth2 is going to provide the best user experience. HTTP Basic Auth is not a great user experience.

You can also allow your resellers to use the OAuth2 authentication, whether by rebranding the OAuth page, wrapping it, or other techniques. The reseller application could be limited in the scopes available to it, and thus you can limit the operations available to the reseller apps.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .