Yaya kake tsare REST API (authentication, authorization, transport)?

Question

IT Interview Practice · Accepted Answer

Tsare REST API yana nufin amsa tambayoyi uku a kowane request: **wanene kai** (authentication), **me aka yardar maka ka yi** (authorization), da **shin tashar tana da sirri** (transport). Saboda REST **stateless** ne, credentials dole su yi tafiya tare da kowane request maimakon zama a session na server.

## Transport: HTTPS koyaushe

Komai a ƙasa yana ɗauka akwai **TLS/HTTPS**. Ba tare da shi ba, tokens da API keys suna tafiya a plaintext kuma ana iya sace su. Wannan ba abin sasantawa ba ne — bearer token a kan HTTP token ne da ya zube.

## Zaɓuɓɓukan authentication

**API keys** — sirri tsayayye a cikin header. Mai sauƙi; yana da kyau ga server-to-server da gane *application*, ba user ba. Rauni su kaɗai (babu ƙarewa, babu scope) sai an haɗa su da ƙari.
```http
GET /data HTTP/1.1
Authorization: Bearer sk_live_a1b2c3...
```

**OAuth 2.0** — ma'auni ga damar shiga **wakilci (delegated)** ("bar App X ya karanta bayanaina ba tare da password na ba"). App yana samun **access token** ta wani flow (misali Authorization Code) kuma yana aika shi a matsayin bearer token. Haka nan "Sign in with Google" da haɗe-haɗe na bangare na uku ke aiki.

**JWT (JSON Web Token)** — *tsari* na kowa ga tokens: token mai sa hannu, mai ƙunshe da kansa yana ɗauke da claims (user id, roles, ƙarewa). Server yana tabbatar da sa hannu — babu bukatar database lookup, wanda ya dace da stateless REST.
```text
header.payload.signature   (base64url)
payload: { "sub": "42", "scope": "orders:read", "exp": 1737800000 }
```

## Authorization: scopes da roles

Authentication yana tabbatar da shaida; **authorization** yana yanke shawarar damar shiga. Tokens suna ɗauke da **scopes** (`orders:read`, `orders:write`) ko roles; server yana duba su ga kowane endpoint kuma yana mayar da `403 Forbidden` idan ba su isa ba (vs `401` ga auth da ya ɓace/marar inganci).

```text
No/invalid token         → 401 Unauthorized
Valid token, no scope    → 403 Forbidden
```

## Sauran abubuwa masu muhimmanci

```text
✓ Short-lived access tokens + refresh tokens (limit blast radius if leaked)
✓ Rate limiting (429) to blunt brute-force and abuse
✓ Validate/sanitize all input; never trust the client
✓ Principle of least privilege on scopes
```

## Me ya sa yake da muhimmanci

Tsaro shi ne inda ƙaramin kuskure ke zama karya, don haka masu hira suna amfani da wannan don ganin ko kana tunani a kansa ta hanyar tsari maimakon karanta buzzwords. Siginar da suke nema ita ce ka **raba shimfidu uku** — transport (HTTPS, koyaushe), authentication (tabbatar da shaida, ba tare da state ba, ta bearer tokens/JWT/OAuth), da authorization (scopes da least privilege) — kuma ba ka haɗa su ba, misali amfani da `401` daidai ga "ba a tantance ba" da `403` ga "an tantance amma ba a yarda ba". Amsoshi masu ƙarfi suna nuna sanin trade-offs na aikace: JWTs suna da dadi kuma stateless amma masu wahalar sokewa kafin su ƙare (saboda haka gajeren rai da refresh tokens), API keys suna gane apps ba users ba, kuma OAuth yana wanzu musamman don users kada su ba da password ɗinsu ga bangare na uku. Haɗa shi da statelessness na REST — credentials a kowane request, babu session na server — yana nuna ka fahimci *dalilin* da ya sa tsaron API ke kama yadda yake.

Transport: HTTPS koyaushe

Zaɓuɓɓukan authentication

Authorization: scopes da roles

Sauran abubuwa masu muhimmanci

Me ya sa yake da muhimmanci

Tambayoyi masu alaƙa