{"action":"created","issue":{"url":"https://api.github.com/repos/silverstripe/silverstripe-restfulserver/issues/34","repository_url":"https://api.github.com/repos/silverstripe/silverstripe-restfulserver","labels_url":"https://api.github.com/repos/silverstripe/silverstripe-restfulserver/issues/34/labels{/name}","comments_url":"https://api.github.com/repos/silverstripe/silverstripe-restfulserver/issues/34/comments","events_url":"https://api.github.com/repos/silverstripe/silverstripe-restfulserver/issues/34/events","html_url":"https://github.com/silverstripe/silverstripe-restfulserver/issues/34","id":137761650,"number":34,"title":"Feature request: Token based authentication","user":{"login":"robbieaverill","id":5170590,"avatar_url":"https://avatars.githubusercontent.com/u/5170590?v=3","gravatar_id":"","url":"https://api.github.com/users/robbieaverill","html_url":"https://github.com/robbieaverill","followers_url":"https://api.github.com/users/robbieaverill/followers","following_url":"https://api.github.com/users/robbieaverill/following{/other_user}","gists_url":"https://api.github.com/users/robbieaverill/gists{/gist_id}","starred_url":"https://api.github.com/users/robbieaverill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robbieaverill/subscriptions","organizations_url":"https://api.github.com/users/robbieaverill/orgs","repos_url":"https://api.github.com/users/robbieaverill/repos","events_url":"https://api.github.com/users/robbieaverill/events{/privacy}","received_events_url":"https://api.github.com/users/robbieaverill/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2016-03-02T03:33:56Z","updated_at":"2016-04-19T16:21:46Z","closed_at":"2016-04-19T16:21:46Z","body":"I personally don't like having basic authentication to protect an API.\r\n\r\nThis is a general feature request, open for discussion, for the suggestion of adding an extra Authenticator for token based authentication (I have a preference for the [Amazon hash signature style](http://docs.aws.amazon.com/AmazonS3/latest/dev/RESTAuthentication.html)!).\r\n\r\nRequirements:\r\n* Exist alongside `BasicRestfulAuthenticator`, not replace\r\n* Be named `TokenRestfulAuthenticator`\r\n* Admin configurable API token interface *attached to Users* where you would define:\r\n * API Token (auto-generated GUID?)\r\n * Private key (auto-generated GUID?)\r\n * Active (bool)\r\n * Description - text input for referencing which tokens are which in admin\r\n* Requests should contain a unix timestamp from when it was generated so that the RestfulServer can enforce a time limit on the request (e.g. 60 seconds)\r\n* Authentication should take the payload and:\r\n * Load the private key that corresponds with the public API token provided\r\n * Create its own hash signature of all the payload data (excluding the provided hash itself, but including the token and the timestamp)\r\n * Compare both the hash with the provided hash\r\n * Enforce the request time limit period\r\n\r\nThis would allow the restfulserver module to ship with a much more secure authentication method, which is relatively easy to use for clients.\r\n\r\nAn example client request might be:\r\n\r\n```php\r\n$private_key = 'yoursupersecretkey';\r\n$request_data = array(\r\n    'token' => 'yourpublicapitoken',\r\n    'timestamp' => time(),\r\n    'fields' => 'Title,URLSegment,Content'\r\n);\r\n\r\n// Generate the hash signature:\r\n$request_data['checksum'] = hash_hmac('sha256', implode($request_data), $private_key);\r\n\r\n// Make API request\r\n```\r\n\r\nOpen for discussion!"},"comment":{"url":"https://api.github.com/repos/silverstripe/silverstripe-restfulserver/issues/comments/212003166","html_url":"https://github.com/silverstripe/silverstripe-restfulserver/issues/34#issuecomment-212003166","issue_url":"https://api.github.com/repos/silverstripe/silverstripe-restfulserver/issues/34","id":212003166,"user":{"login":"dhensby","id":563596,"avatar_url":"https://avatars.githubusercontent.com/u/563596?v=3","gravatar_id":"","url":"https://api.github.com/users/dhensby","html_url":"https://github.com/dhensby","followers_url":"https://api.github.com/users/dhensby/followers","following_url":"https://api.github.com/users/dhensby/following{/other_user}","gists_url":"https://api.github.com/users/dhensby/gists{/gist_id}","starred_url":"https://api.github.com/users/dhensby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dhensby/subscriptions","organizations_url":"https://api.github.com/users/dhensby/orgs","repos_url":"https://api.github.com/users/dhensby/repos","events_url":"https://api.github.com/users/dhensby/events{/privacy}","received_events_url":"https://api.github.com/users/dhensby/received_events","type":"User","site_admin":false},"created_at":"2016-04-19T16:21:46Z","updated_at":"2016-04-19T16:21:46Z","body":"Also, I'm afraid I'm going to close this as the issue trackers aren't for feature requests :( sorry"}}