{"action":"created","issue":{"url":"https://api.github.com/repos/oneshot/oslo/issues/3","labels_url":"https://api.github.com/repos/oneshot/oslo/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/oneshot/oslo/issues/3/comments","events_url":"https://api.github.com/repos/oneshot/oslo/issues/3/events","html_url":"https://github.com/oneshot/oslo/issues/3","id":57367701,"number":3,"title":"Token-based authentication in REST APIs.","user":{"login":"mewwts","id":1848670,"avatar_url":"https://avatars.githubusercontent.com/u/1848670?v=3","gravatar_id":"","url":"https://api.github.com/users/mewwts","html_url":"https://github.com/mewwts","followers_url":"https://api.github.com/users/mewwts/followers","following_url":"https://api.github.com/users/mewwts/following{/other_user}","gists_url":"https://api.github.com/users/mewwts/gists{/gist_id}","starred_url":"https://api.github.com/users/mewwts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mewwts/subscriptions","organizations_url":"https://api.github.com/users/mewwts/orgs","repos_url":"https://api.github.com/users/mewwts/repos","events_url":"https://api.github.com/users/mewwts/events{/privacy}","received_events_url":"https://api.github.com/users/mewwts/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-02-11T19:51:23Z","updated_at":"2015-02-13T13:22:02Z","closed_at":null,"body":"Hey guys!\r\n\r\nI'd like to propose a talk surrounding authenticating users in a REST API, more specifically in a Node.js server. A common issue when creating RESTful applications is authenticating the clients that connect to the API. There are several ways to handle authentication, but token-based seems to be the solution that the community is converging towards. Personally I find the token-based authentication to be almost hassle-free, especially with the node ecosystem in my back pocket.\r\n\r\nToken-based authentication resolves around three steps. \r\n1. Initial authentication. This can be done with the traditional username + password and a database.\r\n2. Handing out JSON web token that decrypts into a user-object.\r\n3. Authenticating subsequent requests that contains an  'authorization' header containing the token.\r\n\r\nIn this talk we will go through a token-based authentication strategy involving passport.js, a JWT library(e.g. jsonwebtoken) and a datastore binding of your choice, for instance mongoose with mongodb.\r\n\r\nSlight extensions of the talk would be storing tokens in a DB and deleting them whenever a user is deleted or logged out. It would also be interesting to visit different strategies for the initial authentication, think OAuth/OpenID/LDAP. There's the subject around attaching user information to audit logs (bunyan), which is quite simple, but useful and not straight forward.\r\n\r\nI'd aim to initially discuss the need of authentication, the few different approaches you might take, and why I've ended up doing things this way. Then proceed to quicky (perhaps with the help of some template code) implementing a API that does authentication, and verify it using cURL. Or even a simple web app with a login-form if we have time. \r\n\r\nAny further ideas? I could submit a more detailed preliminary outline of the talk if this topic is of any interest."},"comment":{"url":"https://api.github.com/repos/oneshot/oslo/issues/comments/74252300","html_url":"https://github.com/oneshot/oslo/issues/3#issuecomment-74252300","issue_url":"https://api.github.com/repos/oneshot/oslo/issues/3","id":74252300,"user":{"login":"mewwts","id":1848670,"avatar_url":"https://avatars.githubusercontent.com/u/1848670?v=3","gravatar_id":"","url":"https://api.github.com/users/mewwts","html_url":"https://github.com/mewwts","followers_url":"https://api.github.com/users/mewwts/followers","following_url":"https://api.github.com/users/mewwts/following{/other_user}","gists_url":"https://api.github.com/users/mewwts/gists{/gist_id}","starred_url":"https://api.github.com/users/mewwts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mewwts/subscriptions","organizations_url":"https://api.github.com/users/mewwts/orgs","repos_url":"https://api.github.com/users/mewwts/repos","events_url":"https://api.github.com/users/mewwts/events{/privacy}","received_events_url":"https://api.github.com/users/mewwts/received_events","type":"User","site_admin":false},"created_at":"2015-02-13T13:22:02Z","updated_at":"2015-02-13T13:22:02Z","body":"Definitely, @sp00x.\r\nIf we consider only the case of limited access to routes, role-based access is quite manageable to cover in this talk. "}}