构建有效的 REST API 身份验证
我已经创建了一个 Web 应用程序，现在我想构建一些 REST API 以使其可由第三方开发人员进行编程。然后，我想用一些流行语言（JavaScript、PHP、Ruby 等）构建一些客户端库，以避免开发人员手动解析每个请求的 JSON 响应，从而使开发人员能够舒适地使用我的服务。
我以前从未构建过 API 基础设施，所以我有以下问题。 我想跟踪第三方开发人员调用的 API 方法的使用情况。每个开发人员在使用 API 之前都必须进行注册，因此我想将每个请求与已注册的开发人员相关联（因此，设置一些特定的使用限制等）。
我想为每个开发人员创建一个唯一的 API 密钥，他可以将其用于所有应用程序，以验证请求。但后来我意识到，如果他决定使用我的 javascript 包装器，那么恶意用户就可以查看客户端应用程序页面的源代码并获取他的 api 密钥。 因此，我决定最好为每个应用程序创建一个唯一的 api 密钥，与托管客户端应用程序的域相关联。这样，即使用户获取了其他人的密钥，那么它在最初注册的域之外也将毫无用处。 但后来我想：移动应用程序怎么样？如果不是从网站拨打电话会怎样？如果没有域或 IP 地址不是静态的，我如何通过域验证密钥？
有什么建议吗？
谢谢！
I've created a web application, and now i want to build some REST APIs to make it programmable by third party developers. Then, i want to build some client libraries in some popular languages (JavaScript, PHP, Ruby, etc) to make devs confortable using my service by avoiding them to parse by hand the JSON response of each request.
I've never built an API infrastructure before, so i have the following question.
I'd like to track the usage of the APIs methods called by third party developers. Each developer, before consuming the APIs, must be registered and so i want to associate each request to the registered developer (and so, set some specific usage limits, etc).
I thought to create an unique api key for each developer that he could use into all his apps, to authenticate the requests. But then i realized that if he decides to use my javascript wrapper, then malicious users could view the source code of the client app page and grab his api key.
So, i decided that it would be better to create a unique api key for every application, associated to the domain where the client app would be hosted. So that even if a user grabs someone else key, then it would be useless outside the domain where it was originally registered.
But then i thought: what about mobile apps? What happens if the call is made not from a website? How can i authenticate the key through its domain if there's no domain or the IP address is not static?
Any tips?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
马可.
不确定您是否仍在处理此问题，但以防万一：如果您的主要目标是跟踪来自不同站点的 API 的使用情况，那么您为每个开发人员分配唯一的 API 密钥是正确的。但是，对于 JavaScript，请求将不是来自该开发人员；而是来自该开发人员。它将来自最终用户的计算机（假设您使用 JSONP 来获取围绕 JavaScript 中的同域策略）。您也许能够使用 HTTP_REFERER 强制执行域限制（即您从 1.2.3.4.comcast.net 收到请求，但其 HTTP_REFERER 是 www.developer.com），但显然，坚定的恶意用户可能会欺骗该 REFERER。
另一种选择可能是避免 JSONP 并让 JavaScript 库附带本地代理。这样，AJAX 调用将从用户的浏览器发送到开发人员的服务器（使用会话 cookie/crumb 进行验证），然后开发人员的服务器联系您的服务器（可以轻松限制 IP 和/或使用强身份验证）。
希望有帮助。
Marco.
Not sure you're still working on this, but just in case: If your main goal is tracking the usage of the API coming from different sites, you're right to assign a unique API key per developer. However, in the case of JavaScript, the request will not be coming from that developer; it would be coming from the end-user's computer (assuming you're using JSONP to get around the same-domain policy in JavaScript). You might be able to enforce your domain restriction using the HTTP_REFERER (i.e. you get a request from 1.2.3.4.comcast.net, but its HTTP_REFERER is www.developer.com) but obviously a determined malicious user could spoof that REFERER.
Another option might be to avoid JSONP and make the JavaScript library come with a local proxy. That way the AJAX calls would go from the user's browser to the developer's server (validated with a session cookie/crumb), and then the developer's server contacts your server (which can be easily IP restricted and/or use strong auth).
Hope that helps.