title: Securing a HTTP API
body: <p>I need to secure a public facing HTTP API <strong>where I can not touch the code on the API server</strong>.</p>
  <p>The HTTP API has multiple end-users that will consume it using non-interactive clients (typically backend services). Just to be clear, the client owns the resources that it will access and as such must provide a user since authorisation logic needs to be tied to a end-user.</p>
  <p>I’m toying with the idea of using <a href="https://www.rfc-editor.org/rfc/rfc6749#section-1" rel="nofollow noreferrer">OAuth2</a>  and the <a href="https://www.rfc-editor.org/rfc/rfc6749#section-4.3" rel="nofollow noreferrer">Resource Owner Password Credentials Grant</a>
  and then using the access token provided to get a <a href="https://www.rfc-editor.org/rfc/rfc7519#section-1" rel="nofollow noreferrer">JWT</a> which the client can present to a HTTP proxy that parses the request before passing it to the HTTP API Server.</p>
  <p>Here is the flow as I envision it:</p>
  <pre><code> +----------+                                  +---------------+
   |          |&gt;--(A)---- Resource Owner -------&gt;|               |
   |          |         Password Credentials     | Authorization |
   | Client   |                                  |     Server    |
   |          |&lt;--(B)---- Access Token ---------&lt;|               |
   |          |    (w/Refresh Token)             |---------------|
   |          |                                  |               |
   |          |&gt;—-(C)---- Request JWT ——--------&gt;| JWT Service   |
   |          |         (w/Access Token)         |               |
   |          |                                  |               |
   |          |&lt;--(D)---- JWT ------------------&lt;|               |
   |          |                                  |               |
   +----------+                                  +---------------+
         v
         |
         |
         |                                       +---------------+
         |                                       |               |
         |                                       |     HTTP      |
         --(E)---- HTTP Request w/JWT ----------&gt;|     Proxy     |
                                                 |               |
                                                 |      (F)      | 
                                                 |               |
                                                 +---------------+
                                                         v
                                                         |
                                                        (G)
                                                         |
                                                         v 
                                                 +---------------+
                                                 |               |
                                                 |     HTTP      |
                                                 |      API      |
                                                 |               |
                                                 +---------------+
   
   (A), (B), (C) Get an access token using the Password Grant flow.
   (D) Use access token to get a JWT.
   (E) Attach JWT to HTTP request and send it to the HTTP Proxy.
   (F) Check that JWT is valid.
   (G) Pass request to the HTTP API Server.    
   
  </code></pre>
  <p>Has anyone else solved a similar use case and would care to shed some light or have a discussion?</p>