Unailindaje REST API (authentication, authorization, transport)?

Question

IT Interview Practice · Accepted Answer

Kulinda REST API humaanisha kujibu maswali matatu kwa kila request: **wewe ni nani** (authentication), **unaruhusiwa kufanya nini** (authorization), na **je kituo ni cha faragha** (transport). Kwa kuwa REST ni **stateless**, credentials lazima zisafiri na kila request badala ya kukaa katika session ya server.

## Transport: HTTPS daima

Kila kitu hapa chini kinadhania **TLS/HTTPS**. Bila hiyo, tokens na API keys husafiri kama plaintext na zinaweza kunusiwa. Hili haliwezekani kujadiliwa — bearer token juu ya HTTP ni token iliyovuja.

## Chaguo za authentication

**API keys** — siri tuli katika header. Rahisi; nzuri kwa server-to-server na kutambua *application*, si user. Dhaifu peke yao (hakuna kuisha muda, hakuna scope) isipokuwa zikiunganishwa na zaidi.
```http
GET /data HTTP/1.1
Authorization: Bearer sk_live_a1b2c3...
```

**OAuth 2.0** — kiwango cha ufikiaji uliokabidhiwa (**delegated**) ("acha App X isome data yangu bila password yangu"). App hupata **access token** kupitia flow (mfano Authorization Code) na huituma kama bearer token. Hivi ndivyo "Sign in with Google" na integrations za wahusika wengine (third-party) zinavyofanya kazi.

**JWT (JSON Web Token)** — *muundo* wa kawaida wa tokens: token iliyotiwa saini, inayojitosheleza, ikibeba claims (user id, roles, kuisha muda). Server huthibitisha saini — hakuna lookup ya database inayohitajika, jambo linalofaa REST stateless.
```text
header.payload.signature   (base64url)
payload: { "sub": "42", "scope": "orders:read", "exp": 1737800000 }
```

## Authorization: scopes na roles

Authentication huthibitisha utambulisho; **authorization** huamua ufikiaji. Tokens hubeba **scopes** (`orders:read`, `orders:write`) au roles; server huzikagua kwa kila endpoint na hurudisha `403 Forbidden` zisipotosha (dhidi ya `401` kwa auth iliyokosekana/batili).

```text
No/invalid token         → 401 Unauthorized
Valid token, no scope    → 403 Forbidden
```

## Mengine muhimu

```text
✓ Short-lived access tokens + refresh tokens (limit blast radius if leaked)
✓ Rate limiting (429) to blunt brute-force and abuse
✓ Validate/sanitize all input; never trust the client
✓ Principle of least privilege on scopes
```

## Kwa nini ni muhimu

Usalama ndipo kosa dogo huwa uvunjaji (breach), hivyo wahoji hutumia hili kuona kama unafikiri kuuhusu kimuundo badala ya kukariri buzzwords. Ishara wanayoitafuta ni kwamba **unatenganisha tabaka tatu** — transport (HTTPS, daima), authentication (kuthibitisha utambulisho, bila hali, kupitia bearer tokens/JWT/OAuth), na authorization (scopes na least privilege) — na kwamba huzichanganyi, mfano kutumia kwa usahihi `401` kwa "haijathibitishwa" dhidi ya `403` kwa "imethibitishwa lakini hairuhusiwi." Majibu imara huonyesha ufahamu wa trade-offs za kivitendo: JWTs ni rahisi na stateless lakini ngumu ku-revoke kabla hazijaisha muda (hivyo maisha mafupi pamoja na refresh tokens), API keys hutambua apps si users, na OAuth ipo mahususi ili users wasikabidhi password yao kwa wahusika wengine. Kuiunganisha na statelessness ya REST — credentials kwa kila request, hakuna session ya server — huonyesha unaelewa *kwa nini* usalama wa API unaonekana jinsi ulivyo.

Transport: HTTPS daima

Chaguo za authentication

Authorization: scopes na roles

Mengine muhimu

Kwa nini ni muhimu

Maswali yanayohusiana