如何使用一种安全的方法API验证用户信息？

Question

I was wondering if anyone would know how to validate a username and a password with an API, i'm pretty sure it would be stupid and unsecure to use

http://api.example.com/profile?uname=name&pass=the-password

I hope that anyone would know how to do this in a secure way?

Thanks!

Answer 1

Using a secure connection, and submitting the Username and Password inside the headers is the best way to accomplish this.

HTTPS ensures that a person cannot simply dissect the packets in-transit. Of course, even in HTTPS, there are many security concerns to throwing sensitive data in the URL (see here: Are https URLs encrypted? ). That's why we use the headers .

See here for sending headers via cURL:

How to send a header using a HTTP request through a curl call?

Once you're sending the proper headers, the API will (of course) need to authorize based on these header values.

The most common way to accomplish this, is to make one endpoint that will authorize with your username and password, then send you an authorization token. Then, once that token is received, you simply include the token in each request. I've seen the token used both ways; via headers and via the url. The great thing is, with time-limited access tokens, you can use tokens inside the URL itself. However, I'm an eternal pessimist and would advise one to still carry the token in the header instead of the URL.

At that point, though, the choice is yours (unless you don't control the API).