There are many ways to secure the REST APIs, from authentication and authorization view point. Below are the two which I know so far:

  1. Using existing token based IAM solutions like Okta, KeyCloak, Auth0, etc.

    • Pros: Already proven solution, feature rich, easy to start and run
    • Cons: Difficult to customize as per needs as the application grows, application becomes dependent on these third party solutions
  2. Building custom solution using filters, interceptors, and JWT (or opaque tokens)

    • Pros: Easy to customize as per needs as we have full control
    • Cons: Chances of error/leaks increases, amount of code to write and manage increases

Above are the points as per my understanding of securing the REST APIs, using token based authentication and authorization. I want to know -

  1. Which of these (or any other) are widely accepted and used in production environments?
  2. Which from these are best suited for small to mid scale projects?
  3. Is there any other way/solution (token based or anything else) to secure the REST APIs?
  1. I think pretty much all of these are used widely but I would recommend avoiding the more customized solutions. JWTs are widely used, for example but I've seen a few articles about their inherent weaknesses as a security solution.
  2. I think this is the wrong way to think about this. When considering security solutions you should consider your threat model instead. Another consideration is: what is the context of the usage? Are these to be accessed by other servers, client applications with human users e.g. browsers?
  3. One option that you don't have listed here is mTLS (client-certificates.) Whether this is a good option for you depends on the context as mentioned in 2. They are useful in situations where you have servers calling your API. They provide basically all of the features that a host certificate provides. To support clients that are controlled by people, using a 3rd party token-based solution is generally more appropriate. It's also possible to support both.
  • Thanks for the reply Jimmy. I am pretty much talking about the human users which are being authenticated. – Jignesh M. Khatri Feb 25 at 4:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.