REST API Access Control - an OPTIONS Based Approach

The REST API architectural style has become a de-facto standard in the development of web services and applications. In order to secure a REST API, access control methods are being used. The current approaches to REST API authorization controls are not standardized and lead to tight coupling between the REST API provider and client. This paper proposes a HTTP semantics compliant method for enforcing authorization rules in a REST API by combining the HTTP OPTIONS method with the HTTP Authorization request header. The proposed approach is REST API agnostic, achieves the decoupling of the authorization method from the REST API client implementation, improves the security of the REST API clients and promotes code reusability and development efficiency.