User registration/authentication flow on a REST API












25














I know this is not the first time the topic is treated in StackOverflow, however, I have some questions I couldn't find an answer to or other questions have opposed answers.



I am doing a rather simple REST API (Silex-PHP) to be consumed initially by just one SPA (backbone app). I don't want to comment all the several authentication methods in this question as that topic is already fully covered on SO. I'll basically create a token for each user, and this token will be attached in every request that requires authentication by the SPA. All the SPA-Server transactions will run under HTTPS. For now, my decision is that the token doesn't expire. Tokens that expire/tokens per session are not complying with the statelessness of REST, right? I understand there's a lot of room for security improvement but that's my scope for now.



I have a model for Tokens, and thus a table in the database for tokens with a FK to user_id. By this I mean the token is not part of my user model.



REGISTER



I have a POST /users (requires no authentication) that creates a user in the database and returns the new user. This complies with the one request one resource rule. However, this brings me certain doubts:




  • My idea is that at the time to create a new user, create a new token for the user, to immediately return it with the Response, and thus, improving the UX. The user will immediately be able to start using the web app. However, returning the token for such response would break the rule of returning just the resource. Should I instead make two requests together? One to create the user and one to retrieve the token without the user needing to reenter credentials?


  • If I decided to return the token together with the user, then I believe POST /users would be confusing for the API consumer, and then something like POST /auth/register appears. Once more, I dislike this idea because involves a verb. I really like the simplicity offered in this answer. But then again, I'd need to do two requests together, a POST /users and a POST /tokens. How wrong is it to do two requests together and also, how would I exactly send the relevant information for the token to be attached to a certain user if both requests are sent together?



For now my flow works like follows:



1. Register form makes a POST /users request
2. Server creates a new user and a new token, returns both in the response (break REST rule)
3. Client now attaches token to every Request that needs Authorization


The token never expires, preserving REST statelessness.



EMAIL VALIDATION



Most of the current webapps require email validation without breaking the UX for the users, i.e the users can immediately use the webapp after registering. On the other side, if I return the token with the register request as suggested above, users will immediately have access to every resource without validating emails.



Normally I'd go for the following workflow:



1. Register form sends POST /users request.
2. Server creates a new user with validated_email set to false and stores an email_validation_token. Additionally, the server sends an email generating an URL that contains the email_validation_token.
3. The user clicks on the URL that makes a request: For example POST /users/email_validation/{email_validation_token}
4. Server validates email, sets validated_email to true, generates a token and returns it in the response, redirecting the user to his home page at the same time.


This looks overcomplicated and totally ruins the UX. How'd you go about it?



LOGIN



This is quite simple, for now I am doing it this way so please correct me if wrong:



1. User fills a log in form which makes a request to POST /login sending Basic Auth credentials.
2. Server checks Basic Auth credentials and returns token for the given user.
3. Web app attached the given token to every future request.


login is a verb and thus breaks a REST rule, everyone seems to agree on doing it this way though.



LOGOUT



Why does everyone seem to need a /auth/logout endpoint? From my point of view clicking on "logout" in the web app should basically remove the token from the application and not send it in further requests. The server plays no role in this.



As it is possible that the token is kept in localStorage to prevent losing the token on a possible page refresh, logout would also imply removing the token from the localStorage. But still, this doesn't affect the server. I understand people who need to have a POST /logout are basically working with session tokens, which again break the statelessness of REST.



REMEMBER ME



I understand the remember me basically refers to saving the returned token to the localStorage or not in my case. Is this right?



If you'd recommend any further reading on this topic I'd very much appreciate it. Thanks!










share|improve this question
























  • Wow it's amazing!! I also entangled with this problem now. Please let me know if you have now answeres for these questions Or if you have a link that helpful .. I will really thank you
    – Moti Winkler
    Apr 13 '16 at 22:46






  • 1




    Hello, I don't have real answers but I have my app on github if you wanna see how I ended up doing it: APP: github.com/mezod/multikanban API: github.com/mezod/multikanban-api
    – mezod
    Apr 24 '16 at 22:14
















25














I know this is not the first time the topic is treated in StackOverflow, however, I have some questions I couldn't find an answer to or other questions have opposed answers.



I am doing a rather simple REST API (Silex-PHP) to be consumed initially by just one SPA (backbone app). I don't want to comment all the several authentication methods in this question as that topic is already fully covered on SO. I'll basically create a token for each user, and this token will be attached in every request that requires authentication by the SPA. All the SPA-Server transactions will run under HTTPS. For now, my decision is that the token doesn't expire. Tokens that expire/tokens per session are not complying with the statelessness of REST, right? I understand there's a lot of room for security improvement but that's my scope for now.



I have a model for Tokens, and thus a table in the database for tokens with a FK to user_id. By this I mean the token is not part of my user model.



REGISTER



I have a POST /users (requires no authentication) that creates a user in the database and returns the new user. This complies with the one request one resource rule. However, this brings me certain doubts:




  • My idea is that at the time to create a new user, create a new token for the user, to immediately return it with the Response, and thus, improving the UX. The user will immediately be able to start using the web app. However, returning the token for such response would break the rule of returning just the resource. Should I instead make two requests together? One to create the user and one to retrieve the token without the user needing to reenter credentials?


  • If I decided to return the token together with the user, then I believe POST /users would be confusing for the API consumer, and then something like POST /auth/register appears. Once more, I dislike this idea because involves a verb. I really like the simplicity offered in this answer. But then again, I'd need to do two requests together, a POST /users and a POST /tokens. How wrong is it to do two requests together and also, how would I exactly send the relevant information for the token to be attached to a certain user if both requests are sent together?



For now my flow works like follows:



1. Register form makes a POST /users request
2. Server creates a new user and a new token, returns both in the response (break REST rule)
3. Client now attaches token to every Request that needs Authorization


The token never expires, preserving REST statelessness.



EMAIL VALIDATION



Most of the current webapps require email validation without breaking the UX for the users, i.e the users can immediately use the webapp after registering. On the other side, if I return the token with the register request as suggested above, users will immediately have access to every resource without validating emails.



Normally I'd go for the following workflow:



1. Register form sends POST /users request.
2. Server creates a new user with validated_email set to false and stores an email_validation_token. Additionally, the server sends an email generating an URL that contains the email_validation_token.
3. The user clicks on the URL that makes a request: For example POST /users/email_validation/{email_validation_token}
4. Server validates email, sets validated_email to true, generates a token and returns it in the response, redirecting the user to his home page at the same time.


This looks overcomplicated and totally ruins the UX. How'd you go about it?



LOGIN



This is quite simple, for now I am doing it this way so please correct me if wrong:



1. User fills a log in form which makes a request to POST /login sending Basic Auth credentials.
2. Server checks Basic Auth credentials and returns token for the given user.
3. Web app attached the given token to every future request.


login is a verb and thus breaks a REST rule, everyone seems to agree on doing it this way though.



LOGOUT



Why does everyone seem to need a /auth/logout endpoint? From my point of view clicking on "logout" in the web app should basically remove the token from the application and not send it in further requests. The server plays no role in this.



As it is possible that the token is kept in localStorage to prevent losing the token on a possible page refresh, logout would also imply removing the token from the localStorage. But still, this doesn't affect the server. I understand people who need to have a POST /logout are basically working with session tokens, which again break the statelessness of REST.



REMEMBER ME



I understand the remember me basically refers to saving the returned token to the localStorage or not in my case. Is this right?



If you'd recommend any further reading on this topic I'd very much appreciate it. Thanks!










share|improve this question
























  • Wow it's amazing!! I also entangled with this problem now. Please let me know if you have now answeres for these questions Or if you have a link that helpful .. I will really thank you
    – Moti Winkler
    Apr 13 '16 at 22:46






  • 1




    Hello, I don't have real answers but I have my app on github if you wanna see how I ended up doing it: APP: github.com/mezod/multikanban API: github.com/mezod/multikanban-api
    – mezod
    Apr 24 '16 at 22:14














25












25








25


11





I know this is not the first time the topic is treated in StackOverflow, however, I have some questions I couldn't find an answer to or other questions have opposed answers.



I am doing a rather simple REST API (Silex-PHP) to be consumed initially by just one SPA (backbone app). I don't want to comment all the several authentication methods in this question as that topic is already fully covered on SO. I'll basically create a token for each user, and this token will be attached in every request that requires authentication by the SPA. All the SPA-Server transactions will run under HTTPS. For now, my decision is that the token doesn't expire. Tokens that expire/tokens per session are not complying with the statelessness of REST, right? I understand there's a lot of room for security improvement but that's my scope for now.



I have a model for Tokens, and thus a table in the database for tokens with a FK to user_id. By this I mean the token is not part of my user model.



REGISTER



I have a POST /users (requires no authentication) that creates a user in the database and returns the new user. This complies with the one request one resource rule. However, this brings me certain doubts:




  • My idea is that at the time to create a new user, create a new token for the user, to immediately return it with the Response, and thus, improving the UX. The user will immediately be able to start using the web app. However, returning the token for such response would break the rule of returning just the resource. Should I instead make two requests together? One to create the user and one to retrieve the token without the user needing to reenter credentials?


  • If I decided to return the token together with the user, then I believe POST /users would be confusing for the API consumer, and then something like POST /auth/register appears. Once more, I dislike this idea because involves a verb. I really like the simplicity offered in this answer. But then again, I'd need to do two requests together, a POST /users and a POST /tokens. How wrong is it to do two requests together and also, how would I exactly send the relevant information for the token to be attached to a certain user if both requests are sent together?



For now my flow works like follows:



1. Register form makes a POST /users request
2. Server creates a new user and a new token, returns both in the response (break REST rule)
3. Client now attaches token to every Request that needs Authorization


The token never expires, preserving REST statelessness.



EMAIL VALIDATION



Most of the current webapps require email validation without breaking the UX for the users, i.e the users can immediately use the webapp after registering. On the other side, if I return the token with the register request as suggested above, users will immediately have access to every resource without validating emails.



Normally I'd go for the following workflow:



1. Register form sends POST /users request.
2. Server creates a new user with validated_email set to false and stores an email_validation_token. Additionally, the server sends an email generating an URL that contains the email_validation_token.
3. The user clicks on the URL that makes a request: For example POST /users/email_validation/{email_validation_token}
4. Server validates email, sets validated_email to true, generates a token and returns it in the response, redirecting the user to his home page at the same time.


This looks overcomplicated and totally ruins the UX. How'd you go about it?



LOGIN



This is quite simple, for now I am doing it this way so please correct me if wrong:



1. User fills a log in form which makes a request to POST /login sending Basic Auth credentials.
2. Server checks Basic Auth credentials and returns token for the given user.
3. Web app attached the given token to every future request.


login is a verb and thus breaks a REST rule, everyone seems to agree on doing it this way though.



LOGOUT



Why does everyone seem to need a /auth/logout endpoint? From my point of view clicking on "logout" in the web app should basically remove the token from the application and not send it in further requests. The server plays no role in this.



As it is possible that the token is kept in localStorage to prevent losing the token on a possible page refresh, logout would also imply removing the token from the localStorage. But still, this doesn't affect the server. I understand people who need to have a POST /logout are basically working with session tokens, which again break the statelessness of REST.



REMEMBER ME



I understand the remember me basically refers to saving the returned token to the localStorage or not in my case. Is this right?



If you'd recommend any further reading on this topic I'd very much appreciate it. Thanks!










share|improve this question















I know this is not the first time the topic is treated in StackOverflow, however, I have some questions I couldn't find an answer to or other questions have opposed answers.



I am doing a rather simple REST API (Silex-PHP) to be consumed initially by just one SPA (backbone app). I don't want to comment all the several authentication methods in this question as that topic is already fully covered on SO. I'll basically create a token for each user, and this token will be attached in every request that requires authentication by the SPA. All the SPA-Server transactions will run under HTTPS. For now, my decision is that the token doesn't expire. Tokens that expire/tokens per session are not complying with the statelessness of REST, right? I understand there's a lot of room for security improvement but that's my scope for now.



I have a model for Tokens, and thus a table in the database for tokens with a FK to user_id. By this I mean the token is not part of my user model.



REGISTER



I have a POST /users (requires no authentication) that creates a user in the database and returns the new user. This complies with the one request one resource rule. However, this brings me certain doubts:




  • My idea is that at the time to create a new user, create a new token for the user, to immediately return it with the Response, and thus, improving the UX. The user will immediately be able to start using the web app. However, returning the token for such response would break the rule of returning just the resource. Should I instead make two requests together? One to create the user and one to retrieve the token without the user needing to reenter credentials?


  • If I decided to return the token together with the user, then I believe POST /users would be confusing for the API consumer, and then something like POST /auth/register appears. Once more, I dislike this idea because involves a verb. I really like the simplicity offered in this answer. But then again, I'd need to do two requests together, a POST /users and a POST /tokens. How wrong is it to do two requests together and also, how would I exactly send the relevant information for the token to be attached to a certain user if both requests are sent together?



For now my flow works like follows:



1. Register form makes a POST /users request
2. Server creates a new user and a new token, returns both in the response (break REST rule)
3. Client now attaches token to every Request that needs Authorization


The token never expires, preserving REST statelessness.



EMAIL VALIDATION



Most of the current webapps require email validation without breaking the UX for the users, i.e the users can immediately use the webapp after registering. On the other side, if I return the token with the register request as suggested above, users will immediately have access to every resource without validating emails.



Normally I'd go for the following workflow:



1. Register form sends POST /users request.
2. Server creates a new user with validated_email set to false and stores an email_validation_token. Additionally, the server sends an email generating an URL that contains the email_validation_token.
3. The user clicks on the URL that makes a request: For example POST /users/email_validation/{email_validation_token}
4. Server validates email, sets validated_email to true, generates a token and returns it in the response, redirecting the user to his home page at the same time.


This looks overcomplicated and totally ruins the UX. How'd you go about it?



LOGIN



This is quite simple, for now I am doing it this way so please correct me if wrong:



1. User fills a log in form which makes a request to POST /login sending Basic Auth credentials.
2. Server checks Basic Auth credentials and returns token for the given user.
3. Web app attached the given token to every future request.


login is a verb and thus breaks a REST rule, everyone seems to agree on doing it this way though.



LOGOUT



Why does everyone seem to need a /auth/logout endpoint? From my point of view clicking on "logout" in the web app should basically remove the token from the application and not send it in further requests. The server plays no role in this.



As it is possible that the token is kept in localStorage to prevent losing the token on a possible page refresh, logout would also imply removing the token from the localStorage. But still, this doesn't affect the server. I understand people who need to have a POST /logout are basically working with session tokens, which again break the statelessness of REST.



REMEMBER ME



I understand the remember me basically refers to saving the returned token to the localStorage or not in my case. Is this right?



If you'd recommend any further reading on this topic I'd very much appreciate it. Thanks!







api rest authentication web-applications asp.net-web-api






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited May 23 '17 at 12:09









Community

11




11










asked Jan 10 '15 at 12:37









mezod

1,2121424




1,2121424












  • Wow it's amazing!! I also entangled with this problem now. Please let me know if you have now answeres for these questions Or if you have a link that helpful .. I will really thank you
    – Moti Winkler
    Apr 13 '16 at 22:46






  • 1




    Hello, I don't have real answers but I have my app on github if you wanna see how I ended up doing it: APP: github.com/mezod/multikanban API: github.com/mezod/multikanban-api
    – mezod
    Apr 24 '16 at 22:14


















  • Wow it's amazing!! I also entangled with this problem now. Please let me know if you have now answeres for these questions Or if you have a link that helpful .. I will really thank you
    – Moti Winkler
    Apr 13 '16 at 22:46






  • 1




    Hello, I don't have real answers but I have my app on github if you wanna see how I ended up doing it: APP: github.com/mezod/multikanban API: github.com/mezod/multikanban-api
    – mezod
    Apr 24 '16 at 22:14
















Wow it's amazing!! I also entangled with this problem now. Please let me know if you have now answeres for these questions Or if you have a link that helpful .. I will really thank you
– Moti Winkler
Apr 13 '16 at 22:46




Wow it's amazing!! I also entangled with this problem now. Please let me know if you have now answeres for these questions Or if you have a link that helpful .. I will really thank you
– Moti Winkler
Apr 13 '16 at 22:46




1




1




Hello, I don't have real answers but I have my app on github if you wanna see how I ended up doing it: APP: github.com/mezod/multikanban API: github.com/mezod/multikanban-api
– mezod
Apr 24 '16 at 22:14




Hello, I don't have real answers but I have my app on github if you wanna see how I ended up doing it: APP: github.com/mezod/multikanban API: github.com/mezod/multikanban-api
– mezod
Apr 24 '16 at 22:14












3 Answers
3






active

oldest

votes


















9














REGISTER




Tokens that expire/tokens per session are not complying with the statelessness of REST, right?




No, there's nothing wrong with that. Many HTTP authentication schemes do have expiring tokens. OAuth2 is super popular for REST services, and many OAuth2 implementations force the client to refresh the access token from time to time.




My idea is that at the time to create a new user, create a new token for the user, to immediately return it with the Response, and thus, improving the UX. The user will immediately be able to start using the web app. However, returning the token for such response would break the rule of returning just the resource. Should I instead make two requests together? One to create the user and one to retrieve the token without the user needing to reenter credentials?




Typically, if you create a new resource following REST best practices, you don't return something in response to a POST like this. Doing this would make the call more RPC-like, so I would agree with you here... it's not perfectly RESTful. I'll offer two solutions to this:




  1. Ignore this, break the best practices. Maybe it's for the best in this case, and making exceptions if they make a lot more sense is sometimes the best thing to do (after careful consideration).

  2. If you want be more RESTful, I'll offer an alternative.


Lets assume you want to use OAuth2 (not a bad idea!). The OAuth2 API is not really RESTful for a number of reasons. I'm my mind it is still better to use a well-defined authentication API, over rolling your own for the sake of being RESTful.



That still leaves you with the problem of creating a user on your API, and in response to this (POST) call, returning a secret which can be used as an access/refresh token.



My alternative is as follows:



You don't need to have a user in order to start a session.



What you can do instead is start the session before you create the user. This guarantees that for any future call, you know you are talking to the same client.



If you start your OAuth2 process and receive your access/refresh token, you can simply do an authenticated POST request on /users. What this means is that your system needs to be aware of 2 types of authenticated users:




  1. Users that logged in with a username/password (`grant_type = passsword1).

  2. Users that logged in 'anonymously' and intend to create a user after the fact. (grant_type = client_credentials).


Once the user is created, you can assign your previously anonymous session with the newly created user entity, thus you don't need to do any access/refresh token exchanges after creation.



EMAIL VALIDATION



Both your suggestions to either:




  • Prevent the user from using the application until email validation is completed.

  • Allow the user to use the application immediately


Are done by applications. Which one is more appropriate really depends on your application and what's best for you. Is there any risk associated with a user starting to use an account with an email they don't own? If no, then maybe it's fine to allow the user in right away.



Here's an example where you don't want to do this: Say if the email address is used by other members of your system to add a user as a friend, the email address is a type of identity. If you don't force users to validate their emails, it means I can act on behalf of someone with a different email address. This is similar to being able to receive invitations, etc. Is this an attack vector? Then you might want to consider blocking the user from using the application until the email is validated.



You might also consider only blocking certain features in your application for which the email address might be sensitive. In the previous example, you could prevent people from seeing invitations from other users until the email is validated.



There's no right answer here, it just depends on how you intend to use the email address.



LOGIN



Please just use OAuth2. The flow you describe is already fairly close to how OAuth2 works. Take it one step further an actually use OAuth2. It's pretty great and once you get over the initial hurdle of understanding the protocol, you'll find that it's easier than you thought and fairly straightforward to just implement the bits you specifically need for your API.



Most of the PHP OAuth2 server implementations are not great. They do too much and are somewhat hard to integrate with. Rolling your own is not that hard and you're already fairly close to building something similar.



LOGOUT



The two reasons you might want a logout endpoint are:




  1. If you use cookie/session based authentication and want to tell the server to forget the session. It sounds like this is not an issue for you.

  2. If you want to tell the server to expire the access/refresh token earlier. Yes, you can just remove them from localstorage, and that might be good enough. Forcing to expire them server-side might give you that little extra confidence. What if someone was able to MITM your browser and now has access to your tokens? I might want to quickly logout and expire all existing tokens. It's an edge case, and I personally have never done this, but that could be a reason why you would want it.


REMEMBER ME



Yea, implementing "remember me" with local storage sounds like a good idea.






share|improve this answer





















  • thanks for taking the time to answer such an old question :)
    – mezod
    Jun 5 '17 at 23:42



















0














I originally took the /LOGON and /LOGOUT approach. I'm starting to explore /PRESENCE. It seems it would help me combine both knowing someone's status and authentication.



0 = Offline
1 = Available
2 = Busy


Going from Offline to anything else should include initial validation (aka require username/password). You could use PATCH or PUT for this (depending how you see it).






share|improve this answer





























    -1














    You are right, SESSION is not allowed in REST, hence there is no need to login or logout in REST service and /login, /logout are not nouns.



    For authentication you could use




    1. Basic authentication over SSL

    2. Digest authentication

    3. OAuth 2

    4. HMAC, etc.


    I prefer to use PUBLIC KEY and PRIVATE KEY [HMAC]



    Private key will never be transmitted over web and I don't care about public key. The public key will be used to make the user specific actions [Who is holding the api key]



    Private key will be know by client app and the server. The private key will be used to create signature. You generate a signature token using private key and add the key into the header. The server will also generate the signature and validate the request for handshake.



    Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b


    Now how you will get private key? you have to do it manually like you put facebook, twitter or google api key on you app.



    However, in some case you can also return [not recommended] the key only for once like Amazon S3 does. They provide "AWS secret access key" at the registration response.






    share|improve this answer

















    • 1




      Authorization header is part of HTTP specification, it has set of predefined authorization schemes like Basic, Digest, NTLM, Kerberos, Bearier, etc. Token is not one of them, so you should use Bearier instead if you mean to be standard compliant.
      – dtoux
      Aug 20 '16 at 2:34












    • Here is a reference iana.org/assignments/http-authschemes/http-authschemes.xhtml
      – dtoux
      Aug 20 '16 at 20:17













    Your Answer






    StackExchange.ifUsing("editor", function () {
    StackExchange.using("externalEditor", function () {
    StackExchange.using("snippets", function () {
    StackExchange.snippets.init();
    });
    });
    }, "code-snippets");

    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "1"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f27876306%2fuser-registration-authentication-flow-on-a-rest-api%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    3 Answers
    3






    active

    oldest

    votes








    3 Answers
    3






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    9














    REGISTER




    Tokens that expire/tokens per session are not complying with the statelessness of REST, right?




    No, there's nothing wrong with that. Many HTTP authentication schemes do have expiring tokens. OAuth2 is super popular for REST services, and many OAuth2 implementations force the client to refresh the access token from time to time.




    My idea is that at the time to create a new user, create a new token for the user, to immediately return it with the Response, and thus, improving the UX. The user will immediately be able to start using the web app. However, returning the token for such response would break the rule of returning just the resource. Should I instead make two requests together? One to create the user and one to retrieve the token without the user needing to reenter credentials?




    Typically, if you create a new resource following REST best practices, you don't return something in response to a POST like this. Doing this would make the call more RPC-like, so I would agree with you here... it's not perfectly RESTful. I'll offer two solutions to this:




    1. Ignore this, break the best practices. Maybe it's for the best in this case, and making exceptions if they make a lot more sense is sometimes the best thing to do (after careful consideration).

    2. If you want be more RESTful, I'll offer an alternative.


    Lets assume you want to use OAuth2 (not a bad idea!). The OAuth2 API is not really RESTful for a number of reasons. I'm my mind it is still better to use a well-defined authentication API, over rolling your own for the sake of being RESTful.



    That still leaves you with the problem of creating a user on your API, and in response to this (POST) call, returning a secret which can be used as an access/refresh token.



    My alternative is as follows:



    You don't need to have a user in order to start a session.



    What you can do instead is start the session before you create the user. This guarantees that for any future call, you know you are talking to the same client.



    If you start your OAuth2 process and receive your access/refresh token, you can simply do an authenticated POST request on /users. What this means is that your system needs to be aware of 2 types of authenticated users:




    1. Users that logged in with a username/password (`grant_type = passsword1).

    2. Users that logged in 'anonymously' and intend to create a user after the fact. (grant_type = client_credentials).


    Once the user is created, you can assign your previously anonymous session with the newly created user entity, thus you don't need to do any access/refresh token exchanges after creation.



    EMAIL VALIDATION



    Both your suggestions to either:




    • Prevent the user from using the application until email validation is completed.

    • Allow the user to use the application immediately


    Are done by applications. Which one is more appropriate really depends on your application and what's best for you. Is there any risk associated with a user starting to use an account with an email they don't own? If no, then maybe it's fine to allow the user in right away.



    Here's an example where you don't want to do this: Say if the email address is used by other members of your system to add a user as a friend, the email address is a type of identity. If you don't force users to validate their emails, it means I can act on behalf of someone with a different email address. This is similar to being able to receive invitations, etc. Is this an attack vector? Then you might want to consider blocking the user from using the application until the email is validated.



    You might also consider only blocking certain features in your application for which the email address might be sensitive. In the previous example, you could prevent people from seeing invitations from other users until the email is validated.



    There's no right answer here, it just depends on how you intend to use the email address.



    LOGIN



    Please just use OAuth2. The flow you describe is already fairly close to how OAuth2 works. Take it one step further an actually use OAuth2. It's pretty great and once you get over the initial hurdle of understanding the protocol, you'll find that it's easier than you thought and fairly straightforward to just implement the bits you specifically need for your API.



    Most of the PHP OAuth2 server implementations are not great. They do too much and are somewhat hard to integrate with. Rolling your own is not that hard and you're already fairly close to building something similar.



    LOGOUT



    The two reasons you might want a logout endpoint are:




    1. If you use cookie/session based authentication and want to tell the server to forget the session. It sounds like this is not an issue for you.

    2. If you want to tell the server to expire the access/refresh token earlier. Yes, you can just remove them from localstorage, and that might be good enough. Forcing to expire them server-side might give you that little extra confidence. What if someone was able to MITM your browser and now has access to your tokens? I might want to quickly logout and expire all existing tokens. It's an edge case, and I personally have never done this, but that could be a reason why you would want it.


    REMEMBER ME



    Yea, implementing "remember me" with local storage sounds like a good idea.






    share|improve this answer





















    • thanks for taking the time to answer such an old question :)
      – mezod
      Jun 5 '17 at 23:42
















    9














    REGISTER




    Tokens that expire/tokens per session are not complying with the statelessness of REST, right?




    No, there's nothing wrong with that. Many HTTP authentication schemes do have expiring tokens. OAuth2 is super popular for REST services, and many OAuth2 implementations force the client to refresh the access token from time to time.




    My idea is that at the time to create a new user, create a new token for the user, to immediately return it with the Response, and thus, improving the UX. The user will immediately be able to start using the web app. However, returning the token for such response would break the rule of returning just the resource. Should I instead make two requests together? One to create the user and one to retrieve the token without the user needing to reenter credentials?




    Typically, if you create a new resource following REST best practices, you don't return something in response to a POST like this. Doing this would make the call more RPC-like, so I would agree with you here... it's not perfectly RESTful. I'll offer two solutions to this:




    1. Ignore this, break the best practices. Maybe it's for the best in this case, and making exceptions if they make a lot more sense is sometimes the best thing to do (after careful consideration).

    2. If you want be more RESTful, I'll offer an alternative.


    Lets assume you want to use OAuth2 (not a bad idea!). The OAuth2 API is not really RESTful for a number of reasons. I'm my mind it is still better to use a well-defined authentication API, over rolling your own for the sake of being RESTful.



    That still leaves you with the problem of creating a user on your API, and in response to this (POST) call, returning a secret which can be used as an access/refresh token.



    My alternative is as follows:



    You don't need to have a user in order to start a session.



    What you can do instead is start the session before you create the user. This guarantees that for any future call, you know you are talking to the same client.



    If you start your OAuth2 process and receive your access/refresh token, you can simply do an authenticated POST request on /users. What this means is that your system needs to be aware of 2 types of authenticated users:




    1. Users that logged in with a username/password (`grant_type = passsword1).

    2. Users that logged in 'anonymously' and intend to create a user after the fact. (grant_type = client_credentials).


    Once the user is created, you can assign your previously anonymous session with the newly created user entity, thus you don't need to do any access/refresh token exchanges after creation.



    EMAIL VALIDATION



    Both your suggestions to either:




    • Prevent the user from using the application until email validation is completed.

    • Allow the user to use the application immediately


    Are done by applications. Which one is more appropriate really depends on your application and what's best for you. Is there any risk associated with a user starting to use an account with an email they don't own? If no, then maybe it's fine to allow the user in right away.



    Here's an example where you don't want to do this: Say if the email address is used by other members of your system to add a user as a friend, the email address is a type of identity. If you don't force users to validate their emails, it means I can act on behalf of someone with a different email address. This is similar to being able to receive invitations, etc. Is this an attack vector? Then you might want to consider blocking the user from using the application until the email is validated.



    You might also consider only blocking certain features in your application for which the email address might be sensitive. In the previous example, you could prevent people from seeing invitations from other users until the email is validated.



    There's no right answer here, it just depends on how you intend to use the email address.



    LOGIN



    Please just use OAuth2. The flow you describe is already fairly close to how OAuth2 works. Take it one step further an actually use OAuth2. It's pretty great and once you get over the initial hurdle of understanding the protocol, you'll find that it's easier than you thought and fairly straightforward to just implement the bits you specifically need for your API.



    Most of the PHP OAuth2 server implementations are not great. They do too much and are somewhat hard to integrate with. Rolling your own is not that hard and you're already fairly close to building something similar.



    LOGOUT



    The two reasons you might want a logout endpoint are:




    1. If you use cookie/session based authentication and want to tell the server to forget the session. It sounds like this is not an issue for you.

    2. If you want to tell the server to expire the access/refresh token earlier. Yes, you can just remove them from localstorage, and that might be good enough. Forcing to expire them server-side might give you that little extra confidence. What if someone was able to MITM your browser and now has access to your tokens? I might want to quickly logout and expire all existing tokens. It's an edge case, and I personally have never done this, but that could be a reason why you would want it.


    REMEMBER ME



    Yea, implementing "remember me" with local storage sounds like a good idea.






    share|improve this answer





















    • thanks for taking the time to answer such an old question :)
      – mezod
      Jun 5 '17 at 23:42














    9












    9








    9






    REGISTER




    Tokens that expire/tokens per session are not complying with the statelessness of REST, right?




    No, there's nothing wrong with that. Many HTTP authentication schemes do have expiring tokens. OAuth2 is super popular for REST services, and many OAuth2 implementations force the client to refresh the access token from time to time.




    My idea is that at the time to create a new user, create a new token for the user, to immediately return it with the Response, and thus, improving the UX. The user will immediately be able to start using the web app. However, returning the token for such response would break the rule of returning just the resource. Should I instead make two requests together? One to create the user and one to retrieve the token without the user needing to reenter credentials?




    Typically, if you create a new resource following REST best practices, you don't return something in response to a POST like this. Doing this would make the call more RPC-like, so I would agree with you here... it's not perfectly RESTful. I'll offer two solutions to this:




    1. Ignore this, break the best practices. Maybe it's for the best in this case, and making exceptions if they make a lot more sense is sometimes the best thing to do (after careful consideration).

    2. If you want be more RESTful, I'll offer an alternative.


    Lets assume you want to use OAuth2 (not a bad idea!). The OAuth2 API is not really RESTful for a number of reasons. I'm my mind it is still better to use a well-defined authentication API, over rolling your own for the sake of being RESTful.



    That still leaves you with the problem of creating a user on your API, and in response to this (POST) call, returning a secret which can be used as an access/refresh token.



    My alternative is as follows:



    You don't need to have a user in order to start a session.



    What you can do instead is start the session before you create the user. This guarantees that for any future call, you know you are talking to the same client.



    If you start your OAuth2 process and receive your access/refresh token, you can simply do an authenticated POST request on /users. What this means is that your system needs to be aware of 2 types of authenticated users:




    1. Users that logged in with a username/password (`grant_type = passsword1).

    2. Users that logged in 'anonymously' and intend to create a user after the fact. (grant_type = client_credentials).


    Once the user is created, you can assign your previously anonymous session with the newly created user entity, thus you don't need to do any access/refresh token exchanges after creation.



    EMAIL VALIDATION



    Both your suggestions to either:




    • Prevent the user from using the application until email validation is completed.

    • Allow the user to use the application immediately


    Are done by applications. Which one is more appropriate really depends on your application and what's best for you. Is there any risk associated with a user starting to use an account with an email they don't own? If no, then maybe it's fine to allow the user in right away.



    Here's an example where you don't want to do this: Say if the email address is used by other members of your system to add a user as a friend, the email address is a type of identity. If you don't force users to validate their emails, it means I can act on behalf of someone with a different email address. This is similar to being able to receive invitations, etc. Is this an attack vector? Then you might want to consider blocking the user from using the application until the email is validated.



    You might also consider only blocking certain features in your application for which the email address might be sensitive. In the previous example, you could prevent people from seeing invitations from other users until the email is validated.



    There's no right answer here, it just depends on how you intend to use the email address.



    LOGIN



    Please just use OAuth2. The flow you describe is already fairly close to how OAuth2 works. Take it one step further an actually use OAuth2. It's pretty great and once you get over the initial hurdle of understanding the protocol, you'll find that it's easier than you thought and fairly straightforward to just implement the bits you specifically need for your API.



    Most of the PHP OAuth2 server implementations are not great. They do too much and are somewhat hard to integrate with. Rolling your own is not that hard and you're already fairly close to building something similar.



    LOGOUT



    The two reasons you might want a logout endpoint are:




    1. If you use cookie/session based authentication and want to tell the server to forget the session. It sounds like this is not an issue for you.

    2. If you want to tell the server to expire the access/refresh token earlier. Yes, you can just remove them from localstorage, and that might be good enough. Forcing to expire them server-side might give you that little extra confidence. What if someone was able to MITM your browser and now has access to your tokens? I might want to quickly logout and expire all existing tokens. It's an edge case, and I personally have never done this, but that could be a reason why you would want it.


    REMEMBER ME



    Yea, implementing "remember me" with local storage sounds like a good idea.






    share|improve this answer












    REGISTER




    Tokens that expire/tokens per session are not complying with the statelessness of REST, right?




    No, there's nothing wrong with that. Many HTTP authentication schemes do have expiring tokens. OAuth2 is super popular for REST services, and many OAuth2 implementations force the client to refresh the access token from time to time.




    My idea is that at the time to create a new user, create a new token for the user, to immediately return it with the Response, and thus, improving the UX. The user will immediately be able to start using the web app. However, returning the token for such response would break the rule of returning just the resource. Should I instead make two requests together? One to create the user and one to retrieve the token without the user needing to reenter credentials?




    Typically, if you create a new resource following REST best practices, you don't return something in response to a POST like this. Doing this would make the call more RPC-like, so I would agree with you here... it's not perfectly RESTful. I'll offer two solutions to this:




    1. Ignore this, break the best practices. Maybe it's for the best in this case, and making exceptions if they make a lot more sense is sometimes the best thing to do (after careful consideration).

    2. If you want be more RESTful, I'll offer an alternative.


    Lets assume you want to use OAuth2 (not a bad idea!). The OAuth2 API is not really RESTful for a number of reasons. I'm my mind it is still better to use a well-defined authentication API, over rolling your own for the sake of being RESTful.



    That still leaves you with the problem of creating a user on your API, and in response to this (POST) call, returning a secret which can be used as an access/refresh token.



    My alternative is as follows:



    You don't need to have a user in order to start a session.



    What you can do instead is start the session before you create the user. This guarantees that for any future call, you know you are talking to the same client.



    If you start your OAuth2 process and receive your access/refresh token, you can simply do an authenticated POST request on /users. What this means is that your system needs to be aware of 2 types of authenticated users:




    1. Users that logged in with a username/password (`grant_type = passsword1).

    2. Users that logged in 'anonymously' and intend to create a user after the fact. (grant_type = client_credentials).


    Once the user is created, you can assign your previously anonymous session with the newly created user entity, thus you don't need to do any access/refresh token exchanges after creation.



    EMAIL VALIDATION



    Both your suggestions to either:




    • Prevent the user from using the application until email validation is completed.

    • Allow the user to use the application immediately


    Are done by applications. Which one is more appropriate really depends on your application and what's best for you. Is there any risk associated with a user starting to use an account with an email they don't own? If no, then maybe it's fine to allow the user in right away.



    Here's an example where you don't want to do this: Say if the email address is used by other members of your system to add a user as a friend, the email address is a type of identity. If you don't force users to validate their emails, it means I can act on behalf of someone with a different email address. This is similar to being able to receive invitations, etc. Is this an attack vector? Then you might want to consider blocking the user from using the application until the email is validated.



    You might also consider only blocking certain features in your application for which the email address might be sensitive. In the previous example, you could prevent people from seeing invitations from other users until the email is validated.



    There's no right answer here, it just depends on how you intend to use the email address.



    LOGIN



    Please just use OAuth2. The flow you describe is already fairly close to how OAuth2 works. Take it one step further an actually use OAuth2. It's pretty great and once you get over the initial hurdle of understanding the protocol, you'll find that it's easier than you thought and fairly straightforward to just implement the bits you specifically need for your API.



    Most of the PHP OAuth2 server implementations are not great. They do too much and are somewhat hard to integrate with. Rolling your own is not that hard and you're already fairly close to building something similar.



    LOGOUT



    The two reasons you might want a logout endpoint are:




    1. If you use cookie/session based authentication and want to tell the server to forget the session. It sounds like this is not an issue for you.

    2. If you want to tell the server to expire the access/refresh token earlier. Yes, you can just remove them from localstorage, and that might be good enough. Forcing to expire them server-side might give you that little extra confidence. What if someone was able to MITM your browser and now has access to your tokens? I might want to quickly logout and expire all existing tokens. It's an edge case, and I personally have never done this, but that could be a reason why you would want it.


    REMEMBER ME



    Yea, implementing "remember me" with local storage sounds like a good idea.







    share|improve this answer












    share|improve this answer



    share|improve this answer










    answered Jun 4 '17 at 20:51









    Evert

    40.4k1569123




    40.4k1569123












    • thanks for taking the time to answer such an old question :)
      – mezod
      Jun 5 '17 at 23:42


















    • thanks for taking the time to answer such an old question :)
      – mezod
      Jun 5 '17 at 23:42
















    thanks for taking the time to answer such an old question :)
    – mezod
    Jun 5 '17 at 23:42




    thanks for taking the time to answer such an old question :)
    – mezod
    Jun 5 '17 at 23:42













    0














    I originally took the /LOGON and /LOGOUT approach. I'm starting to explore /PRESENCE. It seems it would help me combine both knowing someone's status and authentication.



    0 = Offline
    1 = Available
    2 = Busy


    Going from Offline to anything else should include initial validation (aka require username/password). You could use PATCH or PUT for this (depending how you see it).






    share|improve this answer


























      0














      I originally took the /LOGON and /LOGOUT approach. I'm starting to explore /PRESENCE. It seems it would help me combine both knowing someone's status and authentication.



      0 = Offline
      1 = Available
      2 = Busy


      Going from Offline to anything else should include initial validation (aka require username/password). You could use PATCH or PUT for this (depending how you see it).






      share|improve this answer
























        0












        0








        0






        I originally took the /LOGON and /LOGOUT approach. I'm starting to explore /PRESENCE. It seems it would help me combine both knowing someone's status and authentication.



        0 = Offline
        1 = Available
        2 = Busy


        Going from Offline to anything else should include initial validation (aka require username/password). You could use PATCH or PUT for this (depending how you see it).






        share|improve this answer












        I originally took the /LOGON and /LOGOUT approach. I'm starting to explore /PRESENCE. It seems it would help me combine both knowing someone's status and authentication.



        0 = Offline
        1 = Available
        2 = Busy


        Going from Offline to anything else should include initial validation (aka require username/password). You could use PATCH or PUT for this (depending how you see it).







        share|improve this answer












        share|improve this answer



        share|improve this answer










        answered Dec 27 '18 at 22:08









        Tyler Montney

        4381518




        4381518























            -1














            You are right, SESSION is not allowed in REST, hence there is no need to login or logout in REST service and /login, /logout are not nouns.



            For authentication you could use




            1. Basic authentication over SSL

            2. Digest authentication

            3. OAuth 2

            4. HMAC, etc.


            I prefer to use PUBLIC KEY and PRIVATE KEY [HMAC]



            Private key will never be transmitted over web and I don't care about public key. The public key will be used to make the user specific actions [Who is holding the api key]



            Private key will be know by client app and the server. The private key will be used to create signature. You generate a signature token using private key and add the key into the header. The server will also generate the signature and validate the request for handshake.



            Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b


            Now how you will get private key? you have to do it manually like you put facebook, twitter or google api key on you app.



            However, in some case you can also return [not recommended] the key only for once like Amazon S3 does. They provide "AWS secret access key" at the registration response.






            share|improve this answer

















            • 1




              Authorization header is part of HTTP specification, it has set of predefined authorization schemes like Basic, Digest, NTLM, Kerberos, Bearier, etc. Token is not one of them, so you should use Bearier instead if you mean to be standard compliant.
              – dtoux
              Aug 20 '16 at 2:34












            • Here is a reference iana.org/assignments/http-authschemes/http-authschemes.xhtml
              – dtoux
              Aug 20 '16 at 20:17


















            -1














            You are right, SESSION is not allowed in REST, hence there is no need to login or logout in REST service and /login, /logout are not nouns.



            For authentication you could use




            1. Basic authentication over SSL

            2. Digest authentication

            3. OAuth 2

            4. HMAC, etc.


            I prefer to use PUBLIC KEY and PRIVATE KEY [HMAC]



            Private key will never be transmitted over web and I don't care about public key. The public key will be used to make the user specific actions [Who is holding the api key]



            Private key will be know by client app and the server. The private key will be used to create signature. You generate a signature token using private key and add the key into the header. The server will also generate the signature and validate the request for handshake.



            Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b


            Now how you will get private key? you have to do it manually like you put facebook, twitter or google api key on you app.



            However, in some case you can also return [not recommended] the key only for once like Amazon S3 does. They provide "AWS secret access key" at the registration response.






            share|improve this answer

















            • 1




              Authorization header is part of HTTP specification, it has set of predefined authorization schemes like Basic, Digest, NTLM, Kerberos, Bearier, etc. Token is not one of them, so you should use Bearier instead if you mean to be standard compliant.
              – dtoux
              Aug 20 '16 at 2:34












            • Here is a reference iana.org/assignments/http-authschemes/http-authschemes.xhtml
              – dtoux
              Aug 20 '16 at 20:17
















            -1












            -1








            -1






            You are right, SESSION is not allowed in REST, hence there is no need to login or logout in REST service and /login, /logout are not nouns.



            For authentication you could use




            1. Basic authentication over SSL

            2. Digest authentication

            3. OAuth 2

            4. HMAC, etc.


            I prefer to use PUBLIC KEY and PRIVATE KEY [HMAC]



            Private key will never be transmitted over web and I don't care about public key. The public key will be used to make the user specific actions [Who is holding the api key]



            Private key will be know by client app and the server. The private key will be used to create signature. You generate a signature token using private key and add the key into the header. The server will also generate the signature and validate the request for handshake.



            Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b


            Now how you will get private key? you have to do it manually like you put facebook, twitter or google api key on you app.



            However, in some case you can also return [not recommended] the key only for once like Amazon S3 does. They provide "AWS secret access key" at the registration response.






            share|improve this answer












            You are right, SESSION is not allowed in REST, hence there is no need to login or logout in REST service and /login, /logout are not nouns.



            For authentication you could use




            1. Basic authentication over SSL

            2. Digest authentication

            3. OAuth 2

            4. HMAC, etc.


            I prefer to use PUBLIC KEY and PRIVATE KEY [HMAC]



            Private key will never be transmitted over web and I don't care about public key. The public key will be used to make the user specific actions [Who is holding the api key]



            Private key will be know by client app and the server. The private key will be used to create signature. You generate a signature token using private key and add the key into the header. The server will also generate the signature and validate the request for handshake.



            Authorization: Token 9944b09199c62bcf9418ad846dd0e4bbdfc6ee4b


            Now how you will get private key? you have to do it manually like you put facebook, twitter or google api key on you app.



            However, in some case you can also return [not recommended] the key only for once like Amazon S3 does. They provide "AWS secret access key" at the registration response.







            share|improve this answer












            share|improve this answer



            share|improve this answer










            answered Mar 31 '15 at 11:55









            Ikrum Hossain

            1406




            1406








            • 1




              Authorization header is part of HTTP specification, it has set of predefined authorization schemes like Basic, Digest, NTLM, Kerberos, Bearier, etc. Token is not one of them, so you should use Bearier instead if you mean to be standard compliant.
              – dtoux
              Aug 20 '16 at 2:34












            • Here is a reference iana.org/assignments/http-authschemes/http-authschemes.xhtml
              – dtoux
              Aug 20 '16 at 20:17
















            • 1




              Authorization header is part of HTTP specification, it has set of predefined authorization schemes like Basic, Digest, NTLM, Kerberos, Bearier, etc. Token is not one of them, so you should use Bearier instead if you mean to be standard compliant.
              – dtoux
              Aug 20 '16 at 2:34












            • Here is a reference iana.org/assignments/http-authschemes/http-authschemes.xhtml
              – dtoux
              Aug 20 '16 at 20:17










            1




            1




            Authorization header is part of HTTP specification, it has set of predefined authorization schemes like Basic, Digest, NTLM, Kerberos, Bearier, etc. Token is not one of them, so you should use Bearier instead if you mean to be standard compliant.
            – dtoux
            Aug 20 '16 at 2:34






            Authorization header is part of HTTP specification, it has set of predefined authorization schemes like Basic, Digest, NTLM, Kerberos, Bearier, etc. Token is not one of them, so you should use Bearier instead if you mean to be standard compliant.
            – dtoux
            Aug 20 '16 at 2:34














            Here is a reference iana.org/assignments/http-authschemes/http-authschemes.xhtml
            – dtoux
            Aug 20 '16 at 20:17






            Here is a reference iana.org/assignments/http-authschemes/http-authschemes.xhtml
            – dtoux
            Aug 20 '16 at 20:17




















            draft saved

            draft discarded




















































            Thanks for contributing an answer to Stack Overflow!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.





            Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


            Please pay close attention to the following guidance:


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f27876306%2fuser-registration-authentication-flow-on-a-rest-api%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            Monofisismo

            Angular Downloading a file using contenturl with Basic Authentication

            Olmecas