While creating REST API, How authentication token should be used

Question

While creating REST API, what is the best practice to use authentication token. API should except the authentication token in url itself or in HTTP-HEADER. What is the best place for the authentication token and why?

Rotem Hermon · Accepted Answer · 2014-08-24 14:03:14Z

1

Best practice is to check out one of the common authentication protocols and probably use an existing stable implementation of it.
OAuth2 is the obvious choice - http://oauth.net/2/

answered Aug 24, 2014 at 14:03

Rotem Hermon

2,14715 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user3432824 Over a year ago

I do agree with you. But there we must have do it by this way. So we don't have choice.

Rotem Hermon Over a year ago

In any case, sending the token as a parameter in the URL is less secure since there's a good chance it will be logged somewhere along the way (on the web server, proxy server etc.).

Collectives™ on Stack Overflow

While creating REST API, How authentication token should be used

1 Answer 1

2 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Related