Basic Authentication with a Guid token for REST api instead of username/password

There is no need for you to create custom headers or authentication schemes at all.

The Bearer authentication scheme is designed exactly for your use case:

Authorization: Bearer e1d9753f-a508-46cc-a428-1787595d63e4

Basic authentication must be as follows:

Authorization: Basic base64EncodedUsernameAndPassword

where base64EncodedUsernameAndPassword is equal to the output of:

base_64_encode(username + ':' + raw_password)

Do not use Basic if the trailing text value is not the above exact algorithm.

If you just want to put whatever value you want after the scheme name, use the Bearer scheme – that is what it was invented for.

Warning

While you can use a simple GUID/UUID as your token, this isn’t really a secure token. Consider using a JWT instead. JWTs can be digitally signed and assigned a TTL so that only the server setting it can a) create it and validate its authenticity and b) ensure it is not used longer than is allowed. While this may be true of your data stored based on the GUID, the JWT approach does not require server state – so it scales far better – and accomplishes the same thing.

Leave a Comment

Hata!: SQLSTATE[HY000] [1045] Access denied for user 'divattrend_liink'@'localhost' (using password: YES)