Enterprise Integration Zone is brought to you in partnership with:

As the Technical Director, Europe for Layer 7 Technologies, Francois Lascelles advises global corporations and governments in designing and implementing secure SOA and cloud based solutions. Francois joined Layer 7 in its first days back in 2002 and has been contributing ever since to the evolution of the SecureSpan SOA infrastructure product line. Francois is co-author of Prentice Hall’s upcoming SOA Security book. Layer 7 Technologies is an Enterprise SOA and Cloud infrastructure provider. Follow me on twitter http://twitter.com/flascelles Francois is a DZone MVB and is not an employee of DZone and has posted 28 posts at DZone. You can read more from them at their website. View Full User Profile

Standardize HMAC, OAuth RESTful Authentication Schemes

  • submit to reddit

As the enterprise is increasingly taking notice of WOA (Web Oriented Architecture) these days, the need for security guidelines and standards for RESTful Web services is becoming more pressing. Sure, RESTful Web services are meant to borrow existing security mechanisms from the web and HTTP Basic over SSL, when done right, is a great way to accomplish shared-secret based authentication. Yet, for better or for worse, it is common to find REST API providers defining their own authentication mechanisms.

Take for example the Amazon S3 REST API’s custom HTTP authentication scheme. Using this mechanism, a requester signs the RESTful request using HMAC and a symmetric key associated with its Amazon account – the shared secret. This signature is attached to the request through the standard HTTP Authorization header. This achieves requester authentication as well as integrity without SSL. The S3 REST API describes the name of the scheme (‘AWS’) as well as precise ordering for the contents covered by the signature which includes the HTTP VERB, URI, payload, etc. Another example is the Microsoft Windows Azure REST API, which defines a very similar mechanism. However, Windows Azure defines different authentication scheme names (multiple flavors) and the contents and ordering of the “string to sign” is also different. Amazon’s and Azure’s mechanisms are very similar. Unfortunately, their differences make them incompatible.

Must RESTful Web service developers support a different authentication mechanism for each provider they wish to connect with? Clearly a standardized mechanism would be useful.

Perhaps to this effect you often hear OAuth being promoted as a standard security mechanism for RESTful Web service APIs. OAuth defines standardized HMAC and RSA based signatures that are carried in the standard HTTP Authorization header. Although OAuth focuses on a specific use case involving a resource owner authorizing a third party to access said resource from a provider, so called two-legged OAuth enables authentication between a requester and a resource provider. One of the issues with this pattern is that the signature (HMAC or RSA) does not cover payloads for POSTing or PUTting typical RESTFul content-types such as xml or json. The OAuth specification stipulates that only payloads of content-type application/x-www-form-urlencoded are covered. All other content-types signed through OAuth are effectively subject to integrity attacks.

A draft specification from Google, the OAuth Request Body Hash specification attempts to address this OAuth shortcoming by describing an extension of the OAuth specification that enables any payloads to be covered by OAuth signatures regardless of their content-type. Is this the correct solution though? After all, the reason for OAuth to not cover integrity for these payloads in the first place is that OAuth does not focus on a generic RESTful service authentication use case in the first place.

Instead of extending OAuth to make it useful beyond its intended purpose, why not standardize HMAC authentication schemes as used by such REST API providers as Amazon S3 and Windows Azure? Such a standard specification would needs to describe clearly the scheme name and the contents of the signature.

Published at DZone with permission of Francois Lascelles, author and DZone MVB.

(Note: Opinions expressed in this article and its replies are the opinions of their respective authors and not those of DZone, Inc.)


Dean Schulze replied on Thu, 2013/01/17 - 11:05am

The link in the article to Amazon S3 REST API's is broken.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.