0

I am currently developing my own project where I want to use an API to connect to the database on a web server.

I understand that when requesting data, you should use GET and when you want to upload data, you should use POST / PUT. The problem occurs when you want to log a user in. You are requesting data, meaning it should be a GET request, however, you do not want the user credentials in the URL since that would be stored on the users history and other networking tools may be able to pick it up since it would not be secured with https.

What would be the best way of requesting user data through an API? I am making the API with the Slim Framework and am requesting the data via an iOS application I am developing in swift. Apart from using the GET method, my API uses JSON to transmit the data.

The credentials I am talking about are to log the user into their account and not API credentials.

3

The short answer is that you don't.

When dealing with web services, a current common approach is to use JWT (it's specified with OAuth2 and other identity frameworks).

Your authentication service validates the user's credentials, and provides a token for you to pass to your web services. With this approach, your web service never deals with the credentials directly.

If for some reason you need to pass the credentials, the same JWT package allows you to have an encrypted envelope to provide the password, but I would argue against this if you can avoid it.

The approach to pass the JWT is the same regardless of the method (GET, POST, PUT, DELETE, PATCH, etc.).

  • Pass the JWT with the Authentication header
  • Your token is a "Bearer" token, so the value is Bearer: big.jwt.token

JWT tokens can be validated, parsed, and used without round trips to authentication services, so they really help with the authorization process.


In general web applications should avoid passing user credentials to the database directly. That makes it difficult to pool connections which are expensive to create, and have real world cost implications if you have per-user licensing agreements. I understand that some applications need to do data concealment based on user permissions, but there are several ways to handle that process. Just about everything you need can be contained in the JWT.

| improve this answer | |
  • Just seen your edit. What I would do is authenticate the user with the JWT request, give them an access token (expiring after 15 mins since the user will not spend much time in the app), and then for every request linked to that user, the access token will be used. Would that be safe? – iProgram Aug 2 '17 at 19:25
  • 2
    The JWT has an expiration field in it, so your service only has to check the validity of the JWT. I.e. if the signature is correct and the expiration is provided then it is good enough. It makes manual editing of the token pretty impossible unless they know your key. If the token expires, then you'll need to request a new token from your auth server. It's pretty safe. Check out the downloadable paper at the website I linked to. It has a lot of good information about that. – Berin Loritsch Aug 2 '17 at 21:00
  • 2
    NOTE: my edit was simply changing "the current approach" to "a current approach"--softening the language a bit. – Berin Loritsch Aug 2 '17 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.