Open
Description
Implement an extendible user authentication mechanism.
- Basic (or API key only, username is apikey)
- Social auth (https://github.com/hybridauth/hybridauth)
- Digest (https://tools.ietf.org/html/rfc7616)
- Bearer (using JWT token) (see : https://jwt.io/introduction/ and https://tools.ietf.org/html/rfc6750)
- WebAuthn (https://github.com/web-auth/webauthn-framework)
Notes
- Bearer is a OAuth2 scheme and should probably not be used outside of that context.
Inspiration
- https://learning.postman.com/docs/postman/sending-api-requests/authorization/
- https://simonwillison.net/2019/Jul/14/sso-asgi/
- https://blog.restcase.com/4-most-used-rest-api-authentication-methods/
- https://pusher.com/docs/channels/library_auth_reference/rest-api#authentication (timestamp, signature, ...)
- https://webauthn-doc.spomky-labs.com/