How do I secure an API that is used in a JavaScript/Ajax client [apigee]?

Question

I am using Apigee as a proxy for a private REST API which allows basic CRUD operations on my database. The front end developer wants to call my API directly from JavaScript/Ajax so I can't use a basic API Key authentication because anyone could view the source of the JS and invoke potentially destructive methods on my API (I'm a away of origin policies in browsers but that wouldn't prevent someone doing a curl and invoking my API outside of the browser).

What is the best approach? Can the UI developer use OAUTH in some way to obtain an access token for each session once the user is authenticated and use that in his Ajax calls? But even then, couldn't that user view the JS source and do something nasty via curl?

Thanks in advance!

Answer 1

OAuth v2 should solve your problem. There are multiple articles and resources on the Apigee web site which discuss when it is best to use OAuth v1 vs. OAuth v2. http://apigee.com/docs/content/apigee-oauth-frequently-asked-questions , a three legged OAuth strategy may work best for you: http://apigee.com/docs/gateway-services/content/oauth . There is an example of that on the Apigee web site.

Answer 2

So you want to authorize a visitor to your 3rd party site, and make sure they can't do anything abusive?

There is no security model for this. Once you authorize the user/session/browser it's free game, he can do whatever he wants.

---

So take a step back here, what abuse to do you want to prevent? Maybe you want to prevent unknown 3rd parties from using your service. In that case you can set up API key authentication underwater which gives you a temporary session key.

There are 3 parties. The user (u), the 3rd party (3) that uses your API, and you (y).

• u requests a session key from 3
• 3 does an underwater request to y with his API key
• y verifies the API key and sends back a session key to 3
• 3 hands the session key to u
• u does the service request to y

If 3 can never obtain a session key your service is safe against unknown 3rd parties.