Secure authentication with REST in PHP

Question

I’m having doubts about how to work with restful system authentication. My case will be user/password and permissions/hierarchies for the user, and until then as most interesting solution found in searches was the work with token, where it is renewed every request to the webservice and sent to the user interface.

Obs: The language used is php and the interface will be in html, but the focus is on secure authentication with REST.

For those who already know/have experience on the subject, what is the most appropriate way to work safely in REST for this case?

Answer 1

Working with a REST API developed with PHP/Symfony2 that uses Oauth v2 authentication.

The idea is that the consumer get a access token by means of a Grant type and that access token has an expiration time of, say, an hour. The authorization happens in the token passage, which occurs through the header Authorization.

When this access token expires, one can get another token using one refresh token or the user credentials themselves (hence the various types of Grant type - password, refresh token etc).

The implementation of this protocol involves, in my case, only 4 tables: oauth_access_token (where users' access tokens are stored), oauth_client (in which are stored the clients that can get access tokens and refresh tokens - you can even create clients for third parties), oauth_refresh_token (in which refresh tokens are stored, which can eventually be exchanged for an access token) and oauth_auth_code.

Finally, I think that this solution is well suited when granting access to the resources of your application. In addition, I usually protect the connection with TSL and use basic authorization on routes that do not require an access token. :)