All geek questions in one place

Web API Security and Authentication - Carrier Token

I am working on a study of the web API methodology and the API as a whole.

I am currently studying authentication.

I know that there are several ways to authenticate and authorize an API. The most common is a bearer token.

I also see SAML, and I know about x509 (from my WCF days).

Today I want to talk about token. The carrier token is passed as the header. The headers are not encrypted, cannot be encrypted ?, therefore, it may be possible for someone to capture the specified token and impersonate the user without consent. This is my view on the carrier token. It seems today many popular services use this authentication method for the API.

What other options exist besides the carrier token, but are more or less as safe as HMACing for message, etc.

I seem to be a little versed in many authentication methods. I am trying to understand more and would like to create a very secure API that allows you to use SSO (Single sign on). If the carrier token is a way, then it’s excellent, it’s very simple and from a turnkey solution. If there is something better and safer, I am open to this, even if the work and time are much longer than the carrier token.

I don’t know why I don’t like the sound of the carrier marker, but it just seems easy to attack and use. Especially for service type payment.

Thanks!

+6
source share
2 answers

Headers are encrypted using HTTPS . The token icon is responsible for security, and now I use it in my corporate application.

+2
source

The carrier token is passed as the header. The headers are not encrypted, so it may be possible for someone to capture the specified token and impersonate the user without consent.

Although this may not always be the ideal solution, you can make sure that you are only transmitting data using https. According to Eran Hammer (who actually advises against using carrier tokens in this article), header information will remain secure if transferred using HTTPS. In addition, you can add your own encryption algorithm to the token or sensitive data when you need to use it again.
See # 8 in 10 Things You Should Know About Tokens

+2
source

Source: https://habr.com/ru/post/974057/

More articles:


All Articles