0

I am interested in the question if there are any possible advantages to securing a given REST API for web clients and mobile apps with http basic authentication (over https of course) over a token-based system as with oauth2 for example (also over https). As I understand it the client has to save some form of a "key" wether it be user/pw or a token of some kind. The big advantages is that a token can be limited in scope (privileges and time/expiration) whereas saved credentials are rather total. So if the client is compromised the damage should be less with a token (depending on its scope).

So my questions is if there are any advantages in e.g. performance or implementation complexity or anything else which would justify using credentials (e.g. http basic with ssl) over tokens?

Improve this question
2

For the most part, a token-based authentication solution would be preferable, however Basic Auth does offer maximum interoperability and downward compatibility. Any client (even a shell script with curl) could consume your service easily, as long as they had valid credentials.

Improve this answer
1
  • 1
    Thank you for the correction. You are right, Basic Auth is only Authentication. Some token-based solutions are both Authentication (authn) and Authorization (authz), such as OAuth. In this case, apples-to-apples comparison would only look at authentication.
    – DTK
    Oct 4 '14 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.