TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Simple Ways to Protect an API

17 pointsby nwjsmithalmost 11 years ago

3 comments

lsh123almost 11 years ago
It is not 100% clear but it looks like the authentication credentials in the blog post are static and are shared between clients (from the code comment: “In real applications, we will not have the authentication credentials lying around in code. We will store them in external configuration.”).<p>This is REALLY bad idea to have static and shared credentials. Especially in the case of mobile client when the client code itself is in a &quot;hostile&quot; environment. A &quot;bad&quot; guy can inspect the code and extract the authentication credentials. As soon as it happens, you need to update <i>all</i> other clients to push the new shared secret.<p>While OAuth protocol has a number of problems, it gets this right: all the tokens are specific to the client and the compromise of one token would not compromise others. The application can react by marking the compromised token as invalid on the server side without requiring expensive clients update.
评论 #7946778 未加载
vijayaggarwalalmost 11 years ago
According to RFC 2617[1], <i>Both Digest and Basic Authentication are very much on the weak end of the security strength spectrum.</i><p>[1]: <a href="http://tools.ietf.org/html/rfc2617#section-4.4" rel="nofollow">http:&#x2F;&#x2F;tools.ietf.org&#x2F;html&#x2F;rfc2617#section-4.4</a>
评论 #7944886 未加载
评论 #7946460 未加载
评论 #7944779 未加载
mobiuscogalmost 11 years ago
Why is the API accessible from the public internet if it&#x27;s not a public API ?
评论 #7945244 未加载