rest api authentication

Question

Question

How do you authenticate with a rest api? The rest api implemention allows us to add in the header Authentication: 'Basic ' + btoa(user + ':' + password) but it is not really secure as a user can inspect and with the right decoding tool see a user password

Discussion (4)2

Log in or sign up to continue

Yaron Munz · Jun 21

The best practice is put a token (that was safely acquired by the sender) rather than a user/password in the header. This token will give you both authentication, authorization and validity (expiration date and time or retention). Then, the recipient can verify those.

0 0

Ashok Kumar · Jun 22

Hello @Sylvie Greverend
Using the Oauth tokens "Bearer tokens" instead of basic for Authorization is another way to handle it.

0 0

score 0 · Answer 1 · 2024-06-24T15:41:02-04:00

Thanks @Yaron Munz, @Ashok Kumar, @Luis Angel Pérez Ramos, I implemented the bearer token I can get from the rest api call "/login". Luis gave the link https://docs.intersystems.com/iris20241/csp/docbook/Doc.View.cls?KEY=ROA.... Just do not forget to activate jwt in the csp of you rest entry point in management portal.

Sorry I published a lot about my auth problem because my task is: I am connecting an angular application to healthshare world: mainly clinical viewer. My customer wants to share sessions.

At first, I was using a csp application to give angular the auth level. It seems to work well. But thanks to intersystems support, I understood clinical is in one csp session and angular is in another one. So now with your advice, I created an angular route guard / angular interceptor to protect access to pages and deliver token in header. (I still have to work on refresh token - I will share some code when clean).

But I am still not connected to healthshare clinical viewer. Clinical viewer is using jwt tokens, and my angular app is called from the healthshare navigation application configuration. I can not figure out how I can use the clinical viewer tokens. Do I have something to do in the url in the hs navigation ui. Some interesting ideas on: openid connect, universal login app, heathshare api user registration.

score 1 · Answer 2 · 2024-07-02T16:00:29-04:00

Excellent posts: https://community.intersystems.com/post/creating-rest-api-jwt-authentication-objectscript, https://community.intersystems.com/post/jwt-authentication-rest, https://docs.intersystems.com/hs20231/csp/docbook/DocBook.UI.Page.cls?KEY=HESECURE_login_app_sso I have still to figure out as my UI does not having a login - coming from clinical/ healthshare viewer navigation - how I can get the first refresh token. Healthshare has some session storages like hs-navigation:refresh_token. Is it the way to go?