A research on API authentication methods , part II

Concrete versus the undefined

On my previous post I was talking about how the other frameworks more or less force you to do something.

Please, bear in mind that I haven't tested the latest versions of those frameworks, mostly due to the fact that I'm not longer interested at all on MVC frameworks or any other kind of acronym they might be using now.

Overall, if you use them, you know that you will have to write a controller, you will have a model that will either model the information and business rules or will act as a wrapper for the database.

And finally, you have the view.

Another key concept, that usually people tend to forget completely when they talk about MVC frameworks is the routing system, sometimes  esoteric.

The one I can talk about is Laravel4 routing system, and what I can say, it offers before and after actions, but I tend to find the fameworks always too bulky.

What do I like, you might be pondering ?.

Microframeworks

What I use the most is Flask, though I have researched Bottle too. In those frameworks, you define a function or method (depends on how you approach it, there is no proper way to do things, and that is what I like), and you define which verbs it will listen.

I guess that there are microframeworks for PHP, but it's a language I'm trying to get rid of.
Don't get me wrong, I'm not a fanatic person that vouches only for one single language, just see it like I've been using it since 2004, that is 10 years of experience.

Have I mastered it ?, I hardly think so. Despite the fact that I've been using it for 10 years, there are things, like the Zend API, custom extensions, all things that I have not had the time, reason, funding to use.

I bet they are good things to have under my belt, but I don't want to be tied to a language forever, that doesn't seems like a good thing.

Anyway, I believe that Flask provides the best option regarding usability for the developer, ease of learning.
As usual, you have a a lot of extensions to add.

Authentication methods

After a long research of several months, usually interrupted by work and other mundane things, I managed to obtain the desired result.

We have the front end application that runs in the browser, that is the following

• backbone
• underscore
• requirejs

In the backend we have this for development

• Flask
• Mongodb
• PostgreSQL

How did I did the authentication ?. 

Very simple.

HTTP Basic

After a long research I saw that every single one was using this, it is the most straightforward way to do it in a crossdomain environment. All my research is viewable on my github page, please select the branch organization.
Knowing what it works, let me first try to write about what I tried before using Basic as the solution.

I was under the impression that I was going to be able to do CORS auth and maintain a session cookie from the client side, but , this proved to be a very difficult task.

CORS has been a subject that has been fascinating me since I discovered it by accident. The possibility of http communication via cross domain was something quite interesting.

The first thing that I had to deal with, was the cross domain and the cookie. As usual, I had to be on the same subdomain, for example

• http://j-vazquez.com/ (Front end, backbone, underscore, requirejs)
• http://api.j-vazquez.com/ (Flask)

But my main problem was that I could return the proper value and the set cookie, but in the domain j-vazquez.com I could never persist the authentication because It never saw the set-cookie header.

So, that is the reason I resorted to http basic.
What I don't find as an elegant solution, is that obviously I can't prompt the user with the password every time he needs to be doing something, this would be quite annoying for him.

My next solution was to use the local db from the browser, that is html5 databases, but again, I don't like the idea of having that there, so my research ended up there, because I fall back to the a proven thing that works fine and despite I think that I will revisit this subject multiple times, I was building my homepage and I always delay it for some reason , so now I do the auth from the backend as I have always done it, but I still use the backbone/underscore solution that is served by flask.