I have an HTTP API endpoint on my server that is encrypted (TLS). It is not a public API; users must sign-in and validate their account/identity to access the API.
When I connect with my test client (using a newly generated keypair client-side each time), I get this response:
{[] [] [Domain Control Validated COMODO SSL Wildcard] [] [] [] [] *.blah.com [{Domain Control Validated} {COMODO SSL Wildcard} {*.blah.com}]}
2015/05/26 10:53:34 client: handshake: true
2015/05/26 10:53:34 client: mutual: true
Everything looks good.
Now, each user of my API must have a public/private keypair kept clientside to use to connect to the API to comply with the TLS protocol. This is all good and well as I understand it.
Users are going to send sensitive data and files through the wire to be stored on my server.
My next step is to authenticate the users and ensure their data is safe in transit. Which should I use?
- HTTP basic auth
- OAUTH
- OAUTH2
I read over https://www.owasp.org/index.php/REST_Security_Cheat_Sheet but it is mostly about securing a public API from attack. The part about securing the data itself is a footnote at the end.