I am currently researching existing authentication/authorization solution that are used for REST APIs. More specifically I'm interested in backend-to-backend interactions but client-to-backend is relevant too.
I looked at few existing solutions and how existing services manage this. It looks like in many cases using JWT tokens is de-facto a standard path. Some services chose other approaches which are fine too. However what confuses me is why not many places require usage of MAC (message authentication digest) to authenticate payload of a request? Existing solutions either rely on a secret simply being attached to every request or sent once in a while to be exchanged to JWT.
Examples:
auth0 offers to send client secret within body of a request to token grant endpoint: https://auth0.com/blog/using-m2m-authorization/
POST https://<YOUR_AUTH0_DOMAIN>/oauth/token Content-Type: application/json { "audience": "<API_IDENTIFIER>", "grant_type": "client_credentials", "client_id": "<YOUR_CLIENT_ID>", "client_secret": "<YOUR_CLIENT_SECRET>" }
Stripe's api: https://stripe.com/docs/api they also using bearer approach and rely on HTTP basic auth to provide secret token to endpoints.
In this article: https://blog.restcase.com/4-most-used-rest-api-authentication-methods/ it's stated:
The previous versions of this spec, OAuth 1.0 and 1.0a, were much more complicated than OAuth 2.0. The biggest change in the latest version is that it’s no longer required to sign each call with a keyed hash.[ ...]
Section 7.1 of OAuth2 framework https://www.rfc-editor.org/rfc/rfc6749#section-7.1 is allowing MAC type of a token but it doesn't seem to be too be used anywhere.
So I've got few questions:
Why is this happening? Is it just a way to simplify things? Are we now in the place where it is possible to completely rely on security provided by TLS and assume that it's impossible to steal secret or tamper with the data? Or is it just not always reasonable to employ such solutions? Is there some kind of a questionnaire one needs to answer to evaluate necessity of requiring signed requests?
Thanks!