Year: 2025
Type: conference-paper
Abstract: The REST API architectural style has become a de-facto standard in the development of web services and applications. In order to secure a REST API, access control methods are being used. The current approaches to REST API authorization controls are not standardized and lead to tight coupling between the REST API provider and client. This paper proposes a HTTP semantics compliant method for enforcing authorization rules in a REST API by combining the HTTP OPTIONS method with the HTTP Authorization request header. The proposed approach is REST API agnostic, achieves the decoupling of the authorization method from the REST API client implementation, improves the security of the REST API clients and promotes code reusability and development efficiency.
Authors: Ioannis Nikolaou, Leonidas Anthopoulos
Institution: University of Thessaly
Language: English
Topic: Access Control and Trust
Subfield: Sociology and Political Science
Field: Social Sciences
Domain: Social Sciences
Open Access status: gold
OpenAlex ID: W4410636884