Which security feature does stateless authentication and authorization use for REST API calls?

REST APIs are designed to be stateless, meaning the server does not store client session information between requests. OAuth 2.0 is an authorization framework that perfectly supports this model. It uses access tokens (often JSON Web Tokens or JWTs) which are sent by the client in the Authorization header of each API request. These tokens are self-contained credentials that carry the necessary information for the server to authenticate the user/client and authorize the specific request based on granted permissions (scopes). This allows the server to process each request independently without maintaining a server-side session.

Cookie-based session authentication is inherently stateful, as the server must store and manage session data corresponding to the cookie's session ID.

API keys are primarily used for identifying the client application (authentication) and typically lack the granular, user-specific authorization capabilities of OAuth 2.

SSL/TLS certificate encryption secures the data in transit at the transport layer but does not handle the application-layer logic for stateless authentication and authorization.

1. Cisco Systems

Inc.

"Cisco DNA Center Platform REST API User Guide

Release 2.3.5"

Authentication and Authorization. This guide states: "To get authorized

you must request an authentication token from Cisco DNA Center. You must include this token in the header of all the subsequent API requests ('X-Auth-Token')." This describes a classic stateless

token-based authentication mechanism.

2. Internet Engineering Task Force (IETF)

"RFC 6749: The OAuth 2.0 Authorization Framework"

Section 1.4. Access Token. The document defines access tokens as "credentials used to access protected resources." The entire framework is designed around the client presenting this token to the resource server

which validates it for each request

a fundamentally stateless interaction.

3. Fielding

R. T.

"Architectural Styles and the Design of Network-based Software Architectures"

Chapter 5: Representational State Transfer (REST)

Section 5.1.3 Stateless. This doctoral dissertation

which defines REST

states: "Each request from client to server must contain all of the information necessary to understand the request

and cannot take advantage of any stored context on the server." Token-based systems like OAuth 2 adhere to this principle. (Available via University of California

Irvine).