Sunday 15 September 2013

Use generated client key and secret for http basic authentication

Use generated client key and secret for http basic authentication

I am building an API for a local online food order delivery service based
in Accra, Ghana. I have been thinking on the lines of HTTP Basic
Authentication over SSL. Yet I want to take it a step further and upon
requesting the user's credentials the first time I will provide a
temporary client access key and secret that will expire in a short period
of time, typically 24 hours. The temporary credentials will be used to
make requests to the resource server to avoid storing the user's "true"
credentials on the client.
Upon expiry of the temporary access key and secret the user will be
prompted to login again, thereby generating another access key and secret
pair.
I want the API to be secure enough yet as simple as possible. Initially I
wanted to use sessions, but I understand using sessions to authenticate an
API is not the recommended practice, but my API will be consumed by only
in-house clients.
Is this a good pattern to use? Any recommendations?
Honestly, I have been trying to avoid the complexity that comes with
implementing something like OAuth 2.0 and keep things as simple as
possible so that I can concentrate on the application logic.

No comments:

Post a Comment