Secure REST APIs

[ozten]

Mozilla websites which consume the MozLDAP web services should do so in a secure manner.

1. They should be done of https

2. They should sign their requests

3. MozLDAP should verify request signatures, before servicing a request.

Each webapp would have to register the following:

AppID: socorro-123456
Secret: somereallylongsecretwhichwasautogenterated

(I need to play with the real APIs more, bear with me)

If the signature is valid, continue servicing the request. Otherwise respond with a 401 or other relevant HTTP code.

Benefits - Operations can lock down who can use mozLDAP. They can change secret AppIDs and Secret keys as needed.

(Updated: removed my original proposal as HAWK is a better idea)

[benadida]

I recommend using a standard way to sign requests, e.g. https://github.com/hueniverse/hawk

[ozten]

Great idea! There is no Python port yet.

@peterbe thoughts?

[ozten]

BASIC Auth could work very well, to unblock shipping.

We've also got a PyHawk library going that supports Client, Server, and Bewit APIs.

[peterbe]

For a 1.0 we're going with basic auth instead.
https://bugzilla.mozilla.org/show_bug.cgi?id=780202#c11