On: Secure Your REST API

[tptacek]

Don't ever use passwords for API authentication. It's an API, not a browser. The users of an API are other programs, not people. Issue single-purpose random credentials.

I didn't think this was something I had to point out about API authentication, but apparently it is.

[CodeMage → tptacek]

I have a stupid question: how do you do this with HTTP Basic auth?

[tptacek → CodeMage]

Generate random long passwords.

[redblacktree → tptacek]

By "don't ever use passwords" you mean, "don't let users set their own passwords," right?

Obviously, you're still using a password if you use HTTP Basic Auth.