TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Ask HN: What is the best way to add authentication to REST API (for mobile)?

36 点作者 etherealkatana超过 6 年前
Newbie Question: What is a secure and accepted way for authentication and authorisation of REST API endpoint for mobile and SPA's? A google search usually yields JWT but from what I know about JWT, it's complex and doesn't support revocation of tokens easily.

9 条评论

chrisgoman超过 6 年前
There are pros and cons of JWT but if you are OK with it, it is not complex if you use a library. JWT purists want everything on the token (no database) but if you are OK with using a database, just store the token and delete it to revoke. When authenticating, add a database query (it's not that bad) in addition to the verification of the token
inoop超过 6 年前
If you&#x27;re using AWS, maybe take a look at Cognito?<p><a href="https:&#x2F;&#x2F;docs.aws.amazon.com&#x2F;cognito&#x2F;latest&#x2F;developerguide&#x2F;what-is-amazon-cognito.html" rel="nofollow">https:&#x2F;&#x2F;docs.aws.amazon.com&#x2F;cognito&#x2F;latest&#x2F;developerguide&#x2F;wh...</a>
stephenr超过 6 年前
If you control both the backend and the front end, just use a session cookie.
评论 #18801937 未加载
azimuth11超过 6 年前
Auth0 is not a bad option.<p>For JWT to support revocation, you must store them in the database and delete them on logout or when they expire.
评论 #18800346 未加载
franzwong超过 6 年前
May be you are interested in this page <a href="https:&#x2F;&#x2F;sushi2k.gitbooks.io&#x2F;the-owasp-mobile-security-testing-guide&#x2F;content&#x2F;0x04e-Testing-Authentication-and-Session-Management.html" rel="nofollow">https:&#x2F;&#x2F;sushi2k.gitbooks.io&#x2F;the-owasp-mobile-security-testin...</a>
akmittal超过 6 年前
JWT is not that complex because there are battle tested libraries available for all languages.
评论 #18801560 未加载
chvid超过 6 年前
Use a session cookie.
fastbeef超过 6 年前
An API Gateway is pretty Quick to set up, but the industry is moving away from it as a concept.<p>Keycloak is nice but requires some work.
评论 #18800170 未加载
whttheuuu超过 6 年前
Depends on your requirements...<p>Quick and easy: Look into Firebase.<p>Powerful&#x2F;extensible: Django + DRF
评论 #18804520 未加载