Authentication scheme for HMAC authentication in Restful services.
Unmesh Joshi <[email protected]> Tue, 18 Jun 2013 17:23:19 +0530
| Newsgroups | gmane.comp.web.services.rest |
|---|---|
| Message-ID | <CAOk+zfffMVtRevZvaOR7j-MLWi7dg+Hh9PObNBNfvbHUm=Ee8A@mail.gmail.com> |
Hi, We have implemented a Restful service with HMAC authentication. Till now, we were using custom authorization header. But it looks like the common practice is to use standard HTTP "Authorization" header with custom authorization scheme. Unfortunately there doesnt seem to be a standard scheme so far for HMAC based authentication. Everyone (Amazon, Azure, etc..) use their own schemes (e.g. "AWS" used by Amazon or "SharedKey""SharedLiteKey" used by Azure http://msdn.microsoft.com/en-us/library/dd179428.aspx). All these schemes are nearly same, but use different scheme identifier. http://tools.ietf.org/html/draft-ietf-httpbis-p7-auth-22 seems to work in progress, but there is no place where all the commonly used authentication schemes are listed. I found this https://github.com/hueniverse/hawk<https://github.com/hueniverse/hawk#security-considerations>. But not sure if this is widely used. I do not want to create a new scheme identifier, something more generic will probably make sense. Thoughts? Thanks, Unmesh