Geschützt: Authentication API

Authentication API. Methods. Authorization required. Method. Path. Request Body. Response Body. Description. POST/login{ email, password}{ secret }If login credentials match an existing user, an authentication secret is created and returned.XGET/logoutSecret is invalidated.XPOST/register/pronto{ email, password, firstname, lastname }{ email }Create a new activated user.XPATCH/user/password{ password }Change password of current user. Resource Access. Requests get authorized via HMAC (hash based message authentication). The authentication header is created like this: Please note that V2 uses the header Authentication, not Authorization. The request headers should look like this: Aglaia uses this information to do the following: use the user name to get its current secrets from session. use the host to reduce the amount of possible secrets. check if the nonce is higher than the stored last nonce for the secret. build the digest from secret, method, path, date and nonce and compare it to the digest in the request. After that, the request is either rejected or the session is validated successfully.