0

So here is a scenario I have a API written JS and exposed using nodejs on a server which I want to offer for use to different client on basis of private key signup. Need to record each GET request client wise in multi tennant fashion for billing and verify client should be using allowed /sigup limit.

How to achieve this using .

BradleyDotNET
  • 60,462
  • 10
  • 96
  • 117
Dev G
  • 1,387
  • 4
  • 26
  • 43

1 Answers1

0

You're question is a little vague, but I'll do my best to give you a hand.

If I were in this situation I would utilize api (public) and secret (private) keys for each client, with a signature. Each request would have to include the public key (either as a field, or header, or however you like) in order to identify the client, and a signature header, as well as a signature generated from a (this may be a little off, its been a while since I did this) HMAC string based on the base64 encoding of the sent information and the specific client's secret key. Because only your service and the client should have this key, you will be able to verify if the signature does not match the client.

Including a way for the client to reset the secret key in the event that it is compromised is also a good idea.

At this point you've identified and verified the client, so you can simply record the request in whatever kind of db you're using. If you want to verify that the client is allowed to make that request you will have to build some kind of permission system (perhaps db tables consisting of what each client is allowed to access, or which clients are allowed to access each resource), as well as a check to ensure that the client hasn't gone over whatever rate-limit you've set.

If this isn't quite what you were asking I apologize, and if you have any further questions feel free to ask.

Nick Mitchinson
  • 5,452
  • 1
  • 25
  • 31
  • I apologize for not clear in my statement, you got my requirement correct in your statements above. For each GET i have to record counter, so that can be verified against allowed hits for this service as per the plan. Will be helpful if you can point me to any tutorial/ sample code? – Dev G Jun 04 '13 at 17:18
  • Unfortunately I do not know of any sample code for this, as much of it is basic checks against your database (do they have permission, increasing counters, etc). As for the signature verifications, Facebook uses a similar scheme for communications with third-party applications. They have some docs at https://developers.facebook.com/docs/facebook-login/using-login-with-games/ which may help you. – Nick Mitchinson Jun 04 '13 at 17:22
  • Thanks Nick, this is helpful. I will go through it. :) – Dev G Jun 04 '13 at 17:24