Secure Access for Public Clients to Web API:s with Minimum Performance Loss

Abstract: A lot of information nowadays is made available through Web APIs on the Internet and without security and encryption; it is very easy for malicious users to access confidential information. The goal was to find out what different mechanisms that are available for providing a safe communication with a web API from web clients and mobile applications with little as possible impact on the performance. Learning, implementing and maintaining the mechanisms are also im- portant aspects looked at in the evaluation. Many mechanisms are available for use to secure the communication but not all are suitable for public clients. The suitable mechanisms are Digest authentication and OAuth 2.0. The chosen mechanisms were developed, tested and evaluated in regard to safety, performance impact and usabil- ity from a company perspective. The authentication and authorization mechanism, which was the most suitable, was OAuth 2.0as it has least impact on performance and better security features than the other mechanisms.