Securing REST API with http auth AND third party OAuth provider

Question

At the moment I have a webapp which offers username/password login or login via Twitter OAuth. I want to add an REST API for this application. Is it possible (and makes it sense) to offer an OAuth login via Twitter for REST API users? Inspired by this post I think about the following authentication flow. Users can login via HTTP authentication AND/OR OAuth:

I created a sample workflow for this problem: https://i.sstatic.net/EM446.png

Mark S. · Accepted Answer · 2011-11-21 19:27:34Z

0

As mentioned in the post you referenced about the authentication flow, you should be looking at OpenID, not OAuth.

answered Nov 21, 2011 at 19:27

Mark S.

4,0274 gold badges25 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Ginkgochris Over a year ago

1. I post information on the users twitter account. So i need OAuth. 2. I analysed a lot of APIs and NONE of them uses OpenID. I admit that for a lot of them OpenID should be enough.

Mark S. Over a year ago

Then I'm confused about what you're asking for. The protocol used to allow users to log into your site with their Twitter Account is OpenID. The protocol used for allowing your application to post data to a user's Twitter account is OAuth. If you want to do both (logging in and posting) then you need to use both.

Ginkgochris Over a year ago

No that's wrong. ;-) OAuth implicitly contains a method to authenticate users in order to authorize consuming applications to access the user's data. OpenID only supports authorization. And Twitter API doesn't support OpenID by the way. Hmm I will implement and prototype and look, if it's working.

Collectives™ on Stack Overflow

Securing REST API with http auth AND third party OAuth provider

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related