I would like to work on a project where I can authenticate or validate a user without the typical user/password combination to authenticate a user in my system. In other words, I would have a API and a frontend web/mobile app, but I need the user to validate in order to use the app.

I was thinking of using some validation send it a code to a mobile device or a link with a hash to the user e-mail, but I don't know if this is the best approach to solve these issues.

  • Why do you want to avoid the typical user/password combo? – Dan Pichelman Apr 1 '16 at 12:45
  • @DanPichelman yes I would like to try something different – Jean Apr 1 '16 at 12:47
  • They could login via Google/Facebook/LinkedIn/.... – BlueWizard Apr 4 '16 at 5:34

Security is not a new problem
Issue certificates
Public Key Infrastructure
certificate based authentication over username and password authentication

| improve this answer | |

Use OAuth 2.0. Google, Microsoft, Facebook, Twitter, and many more are reputable OAuth 2.0 providers that you can validate users against. You can authorize a client or a server without having to store user id and passwords.

For example, if you have a web server, you can use this to authenticate clients: https://developers.google.com/identity/sign-in/web/server-side-flow

If you have only a client, it's even easier.

| improve this answer | |

I think the best approach is to use other authenticating agencies; Google, Facebook, LinkedIn, Github, etc. This approach involves using oAuth (typically) and would involve the smallest surprise for your users.

The downside of this approach is the end user must have at least one of these accounts to access your app.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.