Practical RESTful service authorization examples?

Question

There are many great SO questions (and answers) about REST and security. Many say that "the purists will not like it, but blah blah" ... and then others say: "You should never do this because blah blah."

But I did not see the solution that the purists offer for the following scenario. So my question is: what are the “clean RESTful solutions” in the following scenario?

A simple scenario ...

Imagine creating a database / website that allows the user to manage their favorite recipes. The website provides a RESTful API so that users can request and manipulate their list from the user program they want to write (which uses this API).

So, user "A" has 3 favorite recipes with identifiers "1", "2" and "3".

User "B" has 2 favorite recipes with identifiers "4" and "5".

We need to make sure that if user A sends a DELETE command to /Recipes/4 , he will receive a Forbidden (403) response Forbidden (403) .

What would I usually do ...

What I would normally do is get them to call the authentication method first and send them some kind of authentication token, which is valid for 30 minutes or so. Usually this token is passed through a cookie.

What is a clean solution?

Is it a pure REST solution to pass it as a variable in the query string? Are cookies a devil? Should I use a token as a segment of a URL (as opposed to a query string parameter)? Is there anything else that clearly answers this question?

Answer 1

Pass the token in the authorization header. This is what it is for. See http://greenbytes.de/tech/webdav/draft-ietf-httpbis-p7-auth-12.html

Answer 2

Process the authentication token as a resource.

You authenticate using the GETting authentication token with the credential parameters (for example, basic auth over https).

Exit the DELETE'y of the authorization token resource that you received when you logged in.

Answer 3

A simple free solution without apathy and cookie will give each of your users an identical token.

There are ways to generate these tokens so that they are sparse enough for security problems.

eg. https://www.grc.com/passwords.htm

Suppose you have user A and user B. You generate token X for user A and token Y for user B.

So user A will use something like /X/Recipes/1

and user B will use something like /Y/Recipes/4

This is safe because user A is the only one who knows his token, and, as I mentioned earlier, the method of generating tokens can guarantee that it is "impossible" for others to guess this token.

So, if someone else, such as user B, uses a different token in the URL, say /Z/Recipes/1 , you should be able to recognize and return the corresponding error message.

You can allow the user to deliver the token in the URL, as I showed above, or embed it in the HTTP request as an Autherticantion message.