Authentication with JWT and JSONAPI

Question

I am implementing REST API using the following technologies/approaches:

I want to implement authentication endpoint, it should receive username and password in POST request in JSONAPI format and return JWT token in JSONAPI format. But I see there are some contradictions that does not allow me to be 100% RESTful:

Let's name endpoint /tokens, because it actually creates tokens. Response would be also resource of type tokens, e.g:

{
  "data": {
    "type": "tokens",
    "attributes": {
      "value": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjEifQ.ivJ5P23wqVo3w31flg3aOu7er--Ijght_RrBf_MuqsU",
    }
  }
}

But how about request? username and password are properties of user, but they should be sent to /tokens endpoint. If I send users resource to /tokens endpoint it does not make much sense.

Is there a way around for this, to follow JSONAPI and keep API meaningful?

What I do in these cases is having a session object or entity which is the one containing the properties you mention and I wouldn't care they're from a user because the user is the one authenticating. In any case, JSONAPI and REST are good guides to follow but apply your style when in need. — Francisco Quintero
– Francisco Quintero, Commented Oct 24, 2018 at 20:33

MvdD · Accepted Answer · 2016-01-15 17:43:36Z

5

If I send users resource to /tokens endpoint it does not make much sense.

Why not? REST does not impose that you only send users to a user resource. Sure, when you CRUD operations on a user resource you'll do this via the user resource endpoint.

But to generate a token, it's totally reasonable to send a user resource to the token endpoint.

answered Jan 15, 2016 at 17:43

MvdD

23.7k9 gold badges72 silver badges99 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Serhii Potapov Over a year ago

Hi, thanks for the reply. > REST does not impose that you only send users to a user resource. REST does not, but REST API specification does. That's the problem.

beauby · Accepted Answer · 2016-03-26 15:15:22Z

2

You could also supply the user credentials via an HTTP Authorization header, or as part of the toplevel meta property of the JSON payload.

answered Mar 26, 2016 at 15:15

beauby

5601 gold badge3 silver badges11 bronze badges

Collectives™ on Stack Overflow

Authentication with JWT and JSONAPI

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related