0

Let's say I have two web applications that are independent of each other.

App1 is written in Python and
App2 is written in Java.

After some logic is done in App1 by normal user, App1 needs to create a realm which can only be done by admin in App2.

curl -H "Content-Type: application/json" \
     -H "Token: admintokenblabla" \
     -X POST \
     -d '{"realm":"myrealm"}' http://localhost/app2/realm/create

I can create realms through the REST API provided that I present the right admin token. The token is created after a success login in App2 (meaning I need to know the username and password)

How can App1 trigger creation of realm in App2 without any admin token? Do I need to hardcode admin's password in App1 and just HTTP request it? (sounds like a very bad solution) What is the industry standard solution to this?

1
  • What is this functionality about? (triggered by regular user and forcing to use admin's functionality). It seems like you're mixing service API and communication between services. It may be necessary to create additional method for service to service with other way of authentication (but it really depends on the functionality). To authenticate service to service communication you can use mentioned here basic auth or to make it more secure certificate. Mar 31, 2017 at 21:09

1 Answer 1

1

It's true, saving passwords in your app is a bad idea. I typically solve this by not using passwords. I use https for my rest.

You can do basic authentication and send credentials on every request or you can set up an auth token that is ephemeral to make successive requests more light weight. This isn't an "admin token". It's a temporary way to quickly say, "hey it's me again". After a reasonable amount of time it expires and you have to send credentials again to get a new auth token.

I recommend you check out this similar stack overflow question:
restful-web-service-how-to-authenticate-requests-from-other-services

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.