I'm planning on making a web app that'll use MySQL as the database, Java/Grails as the backend and JavaScript/VueJS as the frontend and then they'll communicate using only RESTful JSON APIs (that way I can have frontend apps running on any platform, all with the same backend). What I'm thinking is that every action (that requires db access) will have to be authenticated so I'm thinking that when a user logs in (successfully) I'll create an "auth token" on the backend, encrypt it and send it to the front end where it gets stored in browser storage so from that point on every time a user does something that token gets used for authentication. But what I'm not sure about how to implement is authentication for user registration (and any other action that doesn't require the user to be logged in, e.g. sending a Contact Us query). For example I could have a "REST_PASSWORD" variable in the front-end JavaScript that gets used for these unlogged-in actions but that's essentially useless because anyone can access the JavaScript code and grab the password.

So my question is what is the best way to implement user registration through a JSON REST API so that my application doesn't get taken advantage of by bots/malicious users? It's been suggested that I implement CAPTCHA on the frontend and while I'm definitely gonna give that a look, I'm wondering if that'll be enough security and/or if I need more that?

  • It's gonna be open to the public and there's not a whole lot you can do if someone wants to abuse it. reCaptchas are a great way to stop non-human registration. – Jacob Hull Jul 10 '17 at 20:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.