Exploring authentication
In the previous chapter, the API we built exposed multiple endpoints. For now, those endpoints are public and don't require any authentication. In a real-world scenario, you would need to secure those endpoints.
The following diagram illustrates the endpoints to be secured by the end of this chapter:
Figure 4.1 – Securing RESTful API endpoints
Listing recipes will require no authentication, while the endpoints responsible for adding, updating, or deleting a recipe will require authentication.
Multiple methods can be used to secure the preceding endpoints—here are a few of the methods we could use: API keys, Basic Auth, client sessions, OpenID Connect, Open Authorization (OAuth) 2.0, and so on. The most basic authentication mechanism is the usage of API keys.
Using API keys
In this method, the client provides a secret, called an API key, in the request header. The key is then verified at the endpoint handler...
