security.md

OAuth 1.0A

Pros:

1. Shared login without giving out your password. (Not our problem)
2. "State-ful" security without cookies or HTTPS (sort-of)
3. Ability to de-authorize

Cons:

1. Super complicated signing algorithm (difficult for client to sign)

Users: Twitter, Flickr, LinkedIn

OAuth 2.0

Pros:

1. Simpler way to accomplish authentication (bearer tokens, not signing)
2. Additional options for securing things (may also use signing, etc.)
3. Can also de-authorize clients (not super helpful for us)

Cons:

1. HTTPS needed for security with bearer tokens
2. Shorter lived authentication required, because of lower security threshhold
3. No standard implementation. Each provider makes up their own rules.

Users: Google, Facebook, etc.

HTTPS w/sessions

Pros:

1. Simple
2. Secure
3. SessionId could be stored in localStorage instead of cookies

Cons:

1. HTTPS adds latency
2. HTTPS adds overhead for servers
3. Cookies can still get hijacked if your domain is only part HTTPS

Users: Facebook (non-API), Google (non-API), everyone else…..

HTTPS + Basic Auth

Pros;

1. Simple
2. Secure

Cons:

1. We need to store password on the client
2. We need to authenticate on every request

Users: github, gowalla, others

More References

• http://www.quora.com/What-are-the-best-practices-to-secure-an-internal-REST-API-in-the-cloud
• http://blog.apigee.com/detail/oauth_20_don_t_throw_the_baby_out_with_the_bathwater_webcast_qa
• http://www.quora.com/OAuth-2-0/How-does-OAuth-2-0-work
• http://stackoverflow.com/questions/4113934/how-is-oauth-2-different-from-oauth-1http://architects.dzone.com/articles/2-legged-oauth-oauth-10-and-20
• http://stackoverflow.com/questions/4968009/api-design-http-basic-authentication-vs-api-token
• http://stackoverflow.com/questions/5511589/securing-an-api-ssl-http-basic-authentication-vs-signature
• http://developer.github.com/v3/