airjukebox/airjukebox-server — Issue #1: Security: Need to issue tokens on first-use, and require on subsequent-use
Author: airjukebox
Created: 2011-10-27 17:57:04+00:00
State: open

At the moment there is no authorization or access control over incoming requests to the airjukebox server API.

This is fine for development purposes, but once in the wild the service would quickly be abused by DoS / spam / manipulation attempts based on the lack of any security controls.

Without requiring explicit authentication, one option is the following:

* On first access to the API - perhaps only via the 'root' service URL ('/'), a GUID token is issued to the calling client
* Subsequent API calls all require this GUID to be passed, and for there to be a record in the system indicating that this is a known user
* All API calls should be made over HTTPS
* Mobile clients may optionally keep the same GUID over time, if there is to be any personalization functionality in future (unknown)

Without HTTPS, sniffing of outgoing requests from wireless access points would be pretty trivial, hence the requirement there.

This approach might need some scrutiny from someone with a bit of client-server security expertise.