1

I've got an endpoint for HTTP GET at api/token which requires a username and password, since HTTP GET can't include a JSON body I don't know how a password should be sent. Also once I get the token, how should it be included in API calls? Just another field in JSON or in the header?

Improve this question
1
  • you may find this interesting: stackoverflow.com/questions/1582894/…, also you can open the browser console and see how each site sends creedentials to the server (for example you may inspect stackoverflow login and discover that the password is beign send hashed from the client) Commented Jun 28, 2020 at 13:02

4 Answers 4

Reset to default
1

You shoud leverage the header Authorization which is the common way to provide credentials within a call to a RESTful service.

This link could give you more hints on this: https://templth.wordpress.com/2015/01/05/implementing-authentication-with-tokens-for-restful-applications/.

Hope it helps you, Thierry

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

1

I suggest to use JSON Web Tokens which could be used in a URL, POST parameter, or an HTTP header.

A good article about JWT is this.

Improve this answer

1 Comment

although jwt token are good working solution for handling authenticated clients; it is not a solution for what the OP is asking for (how to send creedentials from client to server)
0

the endpoint api/token should be and HTTP/POST so you can send the username and password in the body.

Then, once you've got the token, it should be sent in every other request using an Authorization Header.

Improve this answer

Comments

0

There's no true practise but only common practice.

  • If possible, switch your route from GET to POST and send your password in the HTTP Body. If not possible, you'll need to append parameters to the URL.
  • Once you retrieve an auth token, add a header to each authenticated request with your token as value (eg. "MyCompany-Auth": "0123456789").

Another good practice is also to use SSL (TLS) over your API calls. You can use a self-signed certificate if you don't want to pay too much.

Improve this answer

1 Comment

There is the standard Authorization header. So he can use Authorization: bearer 0123456789.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.