How to ensure user authentication for REST requests?

Question

Information Security

How is the check of the rights to create / read / change / delete in requests to the site api achieved? At the same time, if the request is made from the internal pages of the site, then how to ensure the security of data for authentication (for example, if this is done through an Ajax request using a user key)?

Answer 1

In my case, everything was implemented in the same way for xhr and regular http requests, I don’t see a fundamental difference.

Answer 2

When a username and password comes from the client, we send him a token. The client must send this token with each request in a special field (we sent it in the header called Authorization).

Answer 3

Use an equivalent of MD5-CRAM (two-cycle authentication).
Almost all hash functions are already available as JS libraries.
You can use parameter passing from any domain to yours via HTML5.
javascript.ru/ajax/cross-origin-2