title: Universal way to authenticate clients and secure a RESTful api
body: <p>I've been digging through stackoverflow / security.stackexchange threads and getting no definite answers on providing a universal way for clients to securely consume RESTful services I'm am building through asp.net's web api. In searching for this answer, I see "authorization" and "authentication" used interchangeably, so I want to point out that I am merely wanting to verify both a requests identity and legitimacy. So, at this point, I am not authenticating users. </p>
  
  <p>Amazon's model seems to be the model referenced when "rolling your own," but, in this context, I do understand Amazon has supplied the "papers" per say, so not much reinvention going on here. This post,
  <a href="http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/" rel="nofollow noreferrer">Designing a Secure REST (Web) API without OAuth</a>, was super helpful. </p>
  
  <p>What I gather is:</p>
  
  <ol>
  <li>The application must require SSL requests, so a GET at "<a href="http://myapi.com/users/1" rel="nofollow noreferrer">http://myapi.com/users/1</a>" should be rejected with a bad request response letting the developer know https is required.</li>
  <li>An app key / secret must be supplied by the client to verify who they are.</li>
  <li>SSL + certificates is a good idea</li>
  <li>Require a nonce value</li>
  <li>When a client registers their app, require input of URL and IP that they will send requests from to verify upon receiving a request. My concern with this has been the portability of an external app, i.e. app is moved to new server with different IP and now it doesn't work. </li>
  </ol>
  
  <p>I have few problems with 2 that, perhaps, my mind can't wrap itself around. First, isn't an app secret supposed to be secret? So, if a javascript client makes a request doesn't this compromise the app key's secrecy? Why have an app secret then when I can verify the requests identity through a combination of verifying app key, nonce value, and server ip? I do understand that a server side language such as php, ruby, or c#.net wouldn't expose the secret, but I would like this to be universally secure for JS and compiled languages alike. </p>
  
  <p>Finally, Facebook has a <a href="https://developers.facebook.com/docs/facebook-login/security/" rel="nofollow noreferrer">developer security checklist</a> telling developers to "Never include your App Secret in client-side or decompilable code," which would suggest an encrypted web.config or the like to me. This solution wouldn't work for exposing the REST service to anyone consuming via javascript.</p>
  
  <p>Other threads I've combed through: <br/>
    <a href="http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/" rel="nofollow noreferrer">http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/</a>  <br/>
    <a href="https://developers.facebook.com/docs/facebook-login/security/" rel="nofollow noreferrer">https://developers.facebook.com/docs/facebook-login/security/</a> <br/>
    <a href="https://stackoverflow.com/questions/7551/best-practices-for-securing-a-rest-api-web-service">Best Practices for securing a REST API / web service</a> <br/>
    <a href="https://stackoverflow.com/questions/454355/security-of-rest-authentication-schemes?lq=1">Security of REST authentication schemes</a> <br/>
    <a href="https://stackoverflow.com/questions/14043397/http-basic-authentication-instead-of-tls-client-certificaiton">HTTP Basic Authentication instead of TLS client certification</a> <br/>
    <a href="https://stackoverflow.com/questions/319530/restful-authentication">RESTful Authentication</a></p>