There are many ways to secure the REST APIs, from authentication and authorization view point. Below are the two which I know so far:
Using existing token based IAM solutions like Okta, KeyCloak, Auth0, etc.
- Pros: Already proven solution, feature rich, easy to start and run
- Cons: Difficult to customize as per needs as the application grows, application becomes dependent on these third party solutions
Building custom solution using filters, interceptors, and JWT (or opaque tokens)
- Pros: Easy to customize as per needs as we have full control
- Cons: Chances of error/leaks increases, amount of code to write and manage increases
Above are the points as per my understanding of securing the REST APIs, using token based authentication and authorization. I want to know -
- Which of these (or any other) are widely accepted and used in production environments?
- Which from these are best suited for small to mid scale projects?
- Is there any other way/solution (token based or anything else) to secure the REST APIs?