Protection of HTTP-based APIs¶
Context¶
This guideline applies for all APIs requiring access protection, which are realized based on HTTP. This includes for example REST APIs. The mechanisms described in this guideline do not suffice for use cases requiring proof of possession.
Description¶
The Siemens Xcelerator IAM Guidelines MUST be followed. The parts of the IAM Guidelines with direct relevance for APIs are provided in the following.
APIs MUST adhere to OAuth 2.0 Bearer Token Usage as described in RFC 6750, including TLS (transport layer security, i.e., HTTPS). API clients MUST provide exactly one header
Authorization: Bearer <ACCESS_TOKEN>
where <ACCESS_TOKEN> is to be replaced with a valid access token.
Examples¶
A client equipped with OAuth 2.0 client credentials has obtained an access token (shortened here)
eyJh...O2ttjH_XC8
from the IAM authorization server responsible for an API. The client then invokes the API by attaching a header
Authorization: Bearer eyJh...O2ttjH_XC8
to all of its requests.