Re: HMAC based authorization - Security for REST services

Check out varnish (no affiliation), vmod-digest.

https://github.com/varnish/libvmod-digest

--
Erlend


On Fri, Feb 8, 2013 at 7:03 AM, unmesh_joshi <[email protected]> wrote:

> **
>
>
> Hi,
>
> For building secure RESTful services, its common practice to have digital
> signature (HMAC hash) in the Authorization Header, along with the secret
> key id. The implementation seems fairly standard where
> 1. Client adds Date: header to the request.
> 2. Client builds digital signature with url path parameters and query
> parameters and headers.
> 3. Client puts Authorization Header as
> Authorization: :
>
> On Server side.
> 1. Server checks existence of required header.
> 2. Server retrieves the private key for the secrete key id provided in the
> Authorization Header (Note: This can be typically done by calling a Key
> Management service over SSL, which is deployed in a secured network)
> 3. Server computes HMAC has with the same method that client has used.
> 4. Server matches the hash with the one provided by the client.
> 5. If the hash matches, server forwards the request for further processing.
> 6. If hashes dont match, server returns 401 UnAuthorized response to
> client.
>
> It is also a standard patterns in Web Services world to use Message
> Interceptor Gateway (listed in
> http://www.coresecuritypatterns.com/patterns.htm).
> This way security gateway is a separate tier between client and the actual
> web service endpoint.
>
> This logic is very standard and I think this can be implemented as a
> Apache plugin, which can intercept the request before forwarding it to
> Application Server.
>
> Is there any such standard plugin developed for Apache or any other web
> server?
>
>  
>