无需用户身份验证即可保护REST Api的最佳方法

Question

Is this even possible.

The given scenario is I am building a store either with ember.js or backbone.js. The store will be able to get all the products and individual products as it should. However when the user wants to buy an item they are taken directly to checkout and there is no cart or user signup/login process. I am wondering if it's possible to somehow authenticate the new POST request that comes in to update the quantity and post back the users shipping info based not on if the user is logged in and has authenticated but maybe based on where the request is being made from? For instance based on IP or based on the signature of the SSL certificate present on the client side.

I've been using Parse to play with a backend and using ember for the front end to this point, ember data offers great resources to interface with REST apis but most require that the key be passed to the request somehow and thus placed right inside the client side code. Not good. How can I achieve this with my given scenario or is it simply not possible?

Answer 1

I am not sure how you will be able to distinguish which of your users ordered what, without somehow having them authenticate themselves.

Online stores generally perform this in one of two ways:

1. Have the user sign up, and log in. This way the user is authenticated and validated
2. Have the user supply shipping information on the page when the user makes a purchase

With option 1, its somewhat obvious how you can know which user orders what, because you have validated the user in your Ember.js app and on your server-side.

With option 2, you still have to create an in-browser cookie or otherwise store an identifier that you can send to your server along with the user data. That way, when the user comes back from making their purchase, you can still identify what the user have purchased, and act accordingly in your app.

So you process will be something like:

1. Create and assign a cookie to your user when they enter your site
2. When the user makes a purchase, you will ask the user for some extra information (shipping info, name, etc). Send this to the server, which will then also receive the cookie-information.
3. When the user comes back from their purchase (I am assuming you are using a third party payment processor here, which will call back with a URL on your server), your server side will know the status of the purchase (approved, rejected, etc), and based on the cookie the user had at the time of purchase, you can show the user the status of their purchase.

The downsides of this is that if the user uses another device, browser or deletes their cookies, that you won't be able to display the user with their previous purchase information.

I hope that answers your questions.