background preloader

Designing a Secure REST (Web) API without OAuth

Designing a Secure REST (Web) API without OAuth
Situation You want to develop a RESTful web API for developers that is secure to use, but doesn’t require the complexity of OAuth and takes a simple “pass the credentials in the query” approach… or something equally-as-easy for people to use, but it needs to be secure. You are a smart guy, so you start to think… Problem You realize that literally passing the credentials over HTTP leaves that data open to being sniffed in plain-text; After the Gawker incident, you realize that plain-text or weakly-hashed anything is usually a bad idea. You realize that hashing the password and sending the hash over the wire in lieu of the plain-text password still gives people sniffing at least the username for the account and a hash of the password that could (in a disturbing number of cases) be looked up in a Rainbow Table. That’s not good, so you scratch your head some more… “Still not quite right!” Solution So you keep searching for articles on “secure API design“… That seems pretty straight forward.

http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/

Essential JavaScript Design Patterns For Beginners Design patterns are reusable solutions to commonly occurring problems in software design. They are both exciting and a fascinating topic to explore in any programming language. One reason for this is that they help us build upon the combined experience of many developers that came before us and ensure we structure our code in an optimized way, meeting the needs of problems we're attempting to solve.

Curious » Eucalyptus: Setting up a private infrastructure cloud There are a few Infrastructure-as-a-Service offerings that available to download and use. Eucalyptus and OpenNebula are two such offerings. I ended up installing and experimenting with both Eucalyptus and OpenNebula. In this blog post, I’ll detail my experience of installing and setting up Eucalyptus 1.6.2 on CentOS. A Better Login System Net.tuts+ has published several great tutorials on user login systems. Most tutorials only deal with authenticating the user, which allows for two levels of security: logged in and not logged in. For many sites, a finer degree of control is needed to control where users can go and what they can do.

10 UI Ideas to Learn from Gumroad) 10 UI Ideas to Learn from Gumroad Gumroad is an exciting new startup that lets anyone sell digital content with just a link. It was founded by the prolific Sahil Lavingia. Backbone patterns Building apps with Backbone.js Here, I try to document the good practices that our team has learned along the way building Backbone applications. This document assumes that you already have some knowledge of Backbone.js, jQuery, and of course, JavaScript itself. Table of contents

A re-introduction to JavaScript Why a re-introduction? Because JavaScript is notorious for being the world's most misunderstood programming language. It is often derided as being a toy, but beneath its layer of deceptive simplicity, powerful language features await. JavaScript is now used by an incredible number of high-profile applications, showing that deeper knowledge of this technology is an important skill for any web or mobile developer. It's useful to start with an overview of the language's history.

Micro Jobs 35 Places to Find Micro Jobs Below are companies that offer micro jobs. These are small gigs, or micro tasks, that pay equally small amounts. Though the tasks aren't hard, the pay is low. So before you get started checking out these microjobs, I recommend you read this article What Is a Micro Job? to find out more about how they pay and what they require.

NoSQL Data Modeling Techniques « Highly Scalable Blog NoSQL databases are often compared by various non-functional criteria, such as scalability, performance, and consistency. This aspect of NoSQL is well-studied both in practice and theory because specific non-functional properties are often the main justification for NoSQL usage and fundamental results on distributed systems like the CAP theorem apply well to NoSQL systems. At the same time, NoSQL data modeling is not so well studied and lacks the systematic theory found in relational databases. In this article I provide a short comparison of NoSQL system families from the data modeling point of view and digest several common modeling techniques.

Zeichick’s Take: Ignore Hadoop at your peril It’s the best software platform named for a toy elephant, and it’s hard to imagine designing a modern data-intensive application without seriously considering Apache’s Hadoop ecosystem as a way to distribute the workload. Hadoop has the same ability to revolutionize data handling that the Apache HTTP server did for websites nearly two decades ago, or what Tomcat did for Web applications, or what Subversion and Git are doing for collaborative software development. Don’t take my word for it. Let me quote from a new study from Transparency Market Research: The demand for Hadoop is increasing globally due to its capability to access data faster and at cheaper cost as compared to RDBMS. Moreover, the exponential increase in the amount of data generated across different application sectors such as retail, BFSI [banking, financial services and insurance], government and healthcare among others is also fueling the growth of Hadoop solutions.

Patterns For Large-Scale JavaScript Application Architecture Today we're going to discuss an effective set of patterns for large-scale JavaScript application architecture. The material is based on my talk of the same name, last presented at LondonJS and inspired by previous work by Nicholas Zakas. Who am I and why am I writing about this topic? I'm currently a JavaScript and UI developer at AOL helping to plan and write the front-end architecture to our next generation of client-facing applications.

Busting 10 myths about Hadoop Although Hadoop and related technologies have been with us for more than five years now, most BI professionals and their business counterparts still harbor a few misconceptions that need to be corrected about Hadoop and related technologies such as MapReduce. The following list of 10 facts will clarify what Hadoop is and does relative to BI/DW, as well as in which business and technology situations Hadoop-based business intelligence (BI), data warehousing (DW), data integration (DI), and analytics can be useful. Fact No. 1: Hadoop consists of multiple products We talk about Hadoop as if it's one monolithic thing, but it's actually a family of open-source products and technologies overseen by the Apache Software Foundation (ASF). Scaling Your JavaScript Applications (Videos) Summary Developers creating JavaScript applications these days usually use a combination of patterns like MVC/MV*, modules, widgets and plugins for their architecture.Whilst this works great for apps that are built at a smaller-scale, what happens when your project starts to grow? In this talk, I present an effective set of design patterns for small, medium and large-scale JavaScript applications. You’ll learn how to separate concerns, keep your application logic decoupled, build modules that can exist on their own or be dropped into other projects and scale your applications to minimize any breakage in the user experience.

To Hadoop or Not to Hadoop? Hadoop is very popular, but is not a solution for all Big Data cases. Here are the questions to ask to determine if Hadoop is right for your problem. Guest blog By Anand Krishnaswamy, ThoughtWorks, Oct 4, 2013. Ruby on Rails Tutorial: Learn Rails by Example book and screencasts by Michael Hartl Michael Hartl Contents Foreword My former company (CD Baby) was one of the first to loudly switch to Ruby on Rails, and then even more loudly switch back to PHP (Google me to read about the drama). This book by Michael Hartl came so highly recommended that I had to try it, and the Ruby on Rails Tutorial is what I used to switch back to Rails again.

Related: