Hands-On RESTful API Design Patterns and Best Practices

Authorization

So far, we've built a sample application investor service with various incorporated patterns. Now, how do we ensure our REST API implementation is accessible only to genuine users and not to everyone? In our example, the investor's list should not be visible to all users, and the stocks URI should not be exposed to anyone other than the legitimate investor. Here comes the Authorization header to help us out. We'll use a scheme called basic authentication as it solves our current requirement. Please note that there are different schemes, such as basic authentication, hash-based message authentication (HMAC), JSON Web Token (JWT), and OAuth 2.0 bearer authentication token scheme, that are available to secure the REST APIs. However, ...