panictriggers/scolix-web

Scolix REST API

scolix-web's Issues

How do we want to manage authentication and sessions?

How do we want to manage authentication and sessions?

Authentication

We have our own authentication system

People can log in on our site with their username/email and password and everything is stored in our database.

Pros

1. Everything follows our privacy policy.
2. We do not depend on another service.

Cons

1. We have to manage the security by ourselves but we are no professionals

We use (an)other service(s) in order to authenticate users.

We use the ouath2 protocol and another service (or multiple services) like Google in order to authenticate users.

Pros

1. We just have to use an oauth2 library and we are good to go.
2. They have to manage the security issues because it is their service.
3. They are better at security than we are.

Cons

1. The service we would be using might have a difference privacy policy than we do which is not wanted.
2. We depend on another service or multiple services.

Suggestions??

Sessions

Where do we want to store the session token?

Cookie

Store the session token in a cookie.

Pros

1. You can add an "expires" property to a cookie which makes sure the cookie is not used after the session expired.

Cons

Does this have any cons over the other methods?

LocalStorage

Store the session token in the localstorage of the browser.

Pros

Does this have any pros over the other methods?

Cons

1. This might not be supported in some very old browsers.
2. localStorage does not support an "expires" property like a cookie does (see Cookie -> pros -> 1), however you can implement a workaround.

Suggestions??

Handle authorization

Discussion/documentation about how we want to handle the authorization for the REST API.