REST API Authentication Basics

# CHAPTER 13

REST API Authentication Basics #

1. Introduction #

2. Learning Objectives #

• Define the term "Authentication" in the context of web APIs.

• Differentiate between Authentication (Who are you?) and Authorization (What can you do?).

• Explain why traditional Server-Side Sessions ($_SESSION) violate REST principles.

• Understand the basics of Token-Based Authentication.

• Describe how authentication data is transmitted via HTTP Headers.

3. Beginner-Friendly Explanation #

• Authentication: Showing your ID card at the airport. It proves *who you are*.

• Authorization: Checking your boarding pass. It proves *where you are allowed to go*.

In a traditional website, when you log in, the server gives you an invisible wristband (a Session Cookie) and remembers you. As long as you stay on the website, you don't have to log in again. In a REST API, the server has amnesia. It forgets who you are the second it finishes serving you. Therefore, to get data, you must show your ID card (a Token) with *every single request you make*.

4. Real-World Examples #

• Website Login: You log into Facebook on Chrome, close the tab, open it tomorrow, and you are still logged in (Stateful Session).

• API Login: A mobile weather app has a secret API Key stored in its code. Every time it asks the weather server for data, it attaches that key to the request to prove it's a legitimate app (Stateless Token).

5. Detailed Code Examples #

The Old Way (Stateful - NOT RESTful):

<?php
session_start();
// The server checks its own memory to see if this user is authenticated
if (isset($_SESSION[&#039;logged_in_user_id'])) {
    echo "Welcome back!";
} else {
    echo "Who are you?";
}
?>

The REST API Way (Stateless - Token Based):

<?php
// The server relies entirely on what the client sends in the request
$headers = getallheaders();
$authHeader = $headers[&#039;Authorization'] ?? '';

// Check if the client provided the secret token
if ($authHeader === &#039;Bearer secret_token_123') {
    echo json_encode(["message" => "Authentication successful!"]);
} else {
    http_response_code(401);
    echo json_encode(["error" => "Unauthorized access. Please provide a valid token."]);
}
?>

6. Request/Response Examples #

Client Request without Token:

GET /my-private-data HTTP/1.1
Host: api.example.com

*Server Response: 401 Unauthorized*

Client Request WITH Token:

GET /my-private-data HTTP/1.1
Host: api.example.com
Authorization: Bearer secret_token_123

*Server Response: 200 OK*

7. HTTP Examples #

8. JSON Examples #

{
  "success": true,
  "message": "Login successful",
  "data": {
    "user_id": 45,
    "name": "Jane",
    "access_token": "abc123xyz987"
  }
}

9. Best Practices #

• Always use HTTPS: If you send a token over plain HTTP, anyone watching the network (like someone on the same public Wi-Fi) can steal the token and impersonate the user. HTTPS encrypts the headers, making the token unreadable to spies.

• Do not pass tokens in the URL: Never do GET /data?token=abc123. URLs are logged in server access logs and browser histories. If the token is in the URL, it will be saved in plain text in multiple places. Always use the Authorization header.

10. Common Mistakes #

• Using Cookies for APIs: While cookies can be used securely, relying on them for APIs often leads to CORS (Cross-Origin Resource Sharing) issues and CSRF (Cross-Site Request Forgery) vulnerabilities. Header-based tokens are much safer for mobile apps and decoupled frontends (like React/Vue).

• Confusing AuthN and AuthZ: Authentication (AuthN) is identity. Authorization (AuthZ) is permissions. Don't mix up the logic.

11. Mini Exercises #

1. 1. Open an API testing tool (like Postman). Find the "Authorization" tab. Notice how it has different types like "Bearer Token", "Basic Auth", and "OAuth 2.0". These are all different methods of passing credentials.

12. Coding Challenges #

13. MCQs with Answers #

14. Interview Questions #

• Q: Explain the difference between Authentication and Authorization.

• Q: Describe how token-based authentication works in a stateless architecture.

• Q: Why is it a massive security risk to put API tokens in the URL query string?

15. FAQs #

Q: Can I use Basic Auth (username:password in the header)? A: Yes, but it is generally discouraged for modern APIs. Sending the actual password with every single request increases the risk of it being intercepted. Tokens are better because if a token is stolen, you can revoke (delete) the token without forcing the user to change their password.

16. Summary #

17. Next Chapter Recommendation #