How to transmit credentials in API

Question

I am currently developing my own project where I want to use an API to connect to the database on a web server.

I understand that when requesting data, you should use GET and when you want to upload data, you should use POST / PUT. The problem occurs when you want to log a user in. You are requesting data, meaning it should be a GET request, however, you do not want the user credentials in the URL since that would be stored on the users history and other networking tools may be able to pick it up since it would not be secured with https.

What would be the best way of requesting user data through an API? I am making the API with the Slim Framework and am requesting the data via an iOS application I am developing in swift. Apart from using the GET method, my API uses JSON to transmit the data.

The credentials I am talking about are to log the user into their account and not API credentials.

Answer 1

The short answer is that you don't.

When dealing with web services, a current common approach is to use JWT (it's specified with OAuth2 and other identity frameworks).

Your authentication service validates the user's credentials, and provides a token for you to pass to your web services. With this approach, your web service never deals with the credentials directly.

If for some reason you need to pass the credentials, the same JWT package allows you to have an encrypted envelope to provide the password, but I would argue against this if you can avoid it.

The approach to pass the JWT is the same regardless of the method (GET, POST, PUT, DELETE, PATCH, etc.).

• Pass the JWT with the Authentication header
• Your token is a "Bearer" token, so the value is Bearer: big.jwt.token

JWT tokens can be validated, parsed, and used without round trips to authentication services, so they really help with the authorization process.

---

In general web applications should avoid passing user credentials to the database directly. That makes it difficult to pool connections which are expensive to create, and have real world cost implications if you have per-user licensing agreements. I understand that some applications need to do data concealment based on user permissions, but there are several ways to handle that process. Just about everything you need can be contained in the JWT.