Authenticating and securing web services
Communication with a ServiceNow instance has two basic starting points:
- It happens over HTTPS. This provides encryption for all the communication and helps prevent man-in-the-middle attacks.
- Authentication is almost always required, usually in the form of a username and password. This ensures that the instance knows who you are.
- Authorization is then applied. Using Security Rules and other mechanisms, the instance can decide if you are entitled to carry out a particular action.
Note
This section focuses on machine-to-machine authentication. The next chapter, explores authorization in much more detail.
Inbound authentication
When systems want to connect to ServiceNow, the most obvious and common way of authenticating is through a username and password. HTTP Basic Authentication asks that a client send these encoded details in the headers of an HTTP request.
Note
The header for basic authentication is Authorization: Basic username:password,with the username...
