Authentication

Authentication Methods

JWT

Publishers can authenticate with the WAYF cloud via the JWT contained in their customized widget JS file. The JWT is enough to authenticate and identify the publisher because part of the claims that are signed during token generation are the publisher's ID. Thus, when receiving a JWT in conjunction with a local ID, the system can decrypt the token to understand which publisher is making the request.

The JWT value is passed in the HTTP authorization header with a prefix of "Bearer". For example, serialized headers may look like:

"headers" : { "Authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.TJVA95OrM7E2cBab30RMHrHDcEfxjoYZgeFONFh7HgQ" }

The JWT value does not expire and must be changed via the publisher's Javascript widget.

Token

Tokens are static strings generated by the server for a specific party. The token may have an expiration date or may by indefinite. Currently, the token is generated as a UUID but the format of the value moving forward is not important.

Each publisher has a token generated for them on registration. This is their API key. When making requests directly to the server (outside of the widget) the publisher must pass their token in the authorization header with a prefix of "Token". For example, serialized headers may look like:

"headers" : { "Authorization": "Token ffffdfe4-a4e2-4abd-8f42-169f5bc14abd" }

A publisher's API token will not expire.

Administrative users may authenticate with the WAYF cloud using their email and password. Once the email and password have been authenticated, the cloud will return to the user a generated API token that expires from two hours after login.

Email and Password

Credentialed users may authenticate with the WAYF cloud via a username and password. All passwords are securely stored in the databse encrypted with BCrypt and user specific salt.

Currently, administrators are the only users with email and password credentials. Those are only used to procure an expiring API token from the WAYF cloud. Users may authenticate via the login endpoint:

POST - /1/user/credentials

{ 
    "email" : "test@atypon.com",
    "password" : "test"
}