2

I have a little trouble understanding, how to use OAuth to secure an API. So I developed a RESTful service, which I would like to secure to authenticated access. I first opted for HTTP Basic + TLS, but then decided to also support OAuth. The Jersey library supports OAuth1. After I got that working, the first consumer of that API will be a web application.

So I need to register a consumer, to obtain a client key, together with a client secret. I need these two to initiate the OAuth1 flow. Therefore the client (web application) need to have them. But that means every user of that webapp has now the client secret and key, and is able to impersonate me as a developer and luring user into phishing traps.This also applies, arguably to a lesser extend to other clients, which might first need to be disassembled. But the ultimate problem still exists.

But there must be a misunderstanding on my side, since such a problem would have surly been in the way of the wildly adoption of it.

One possibility that comes to my mind is, as a client developer, initiating OAuth only server-side. Is this the solution, or is there no such problem?

  • 2
    This question entirely hinges on something that you left out: How the hell are you using oauth? OAuth strength is that it is versatile. – rook Nov 13 '14 at 15:26
2

OAuth can be used in many different ways. If an OAuth tokens is being issued to your web application using your secret key (making your web application into the 'client'), then no one should access this token, rather the role of your web service is to perform actions on behalf of other clients and your application must have access control in place.

Alternatively, OAuth is also used to authenticate browsers. So if a browser is going through a 3-legged OAuth flow, and then provides your application access to a 3rd party web resource. Then essentially the browser owns this token, and is letting your web service utilize this OAuth token. The client is trusting your web service to keep this OAuth token a secret.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.