A resource named /item is protected by oAuth2 authentication. An endpoint named /login must request authentication. Which method must be used to access the resource by using the REST API?

Question

Options

• AMake a GET call to /login that includes the username and password, and retrieve a token to insert
• BMake a POST call to /login including the user credentials in the message, and retrieve a token to
• CMake a GET call to /item, then make a call to /login that includes the username and password in
• DMake a POST call to /item that includes the username and password in the body of the request

• B
  93% (39)
• C
  5% (2)
• D
  2% (1)

Explanation

OAuth2 authentication follows a two-step flow: first, obtain a token by authenticating; second, use that token to access the protected resource. Credentials (username/password) must be sent via POST, not GET, because GET requests embed data in the URL (which is logged and cached - a security risk), whereas POST sends credentials in the request body, which is more secure. Option A is wrong because GET should not be used to submit credentials. Option C is wrong because you do not make an unauthenticated call to /item first - authentication must precede resource access. Option D is wrong because credentials should not be sent directly to /item in the body; /item expects a token, not raw credentials. Therefore, POST to /login for a token, then use the token to call /item, is the correct OAuth2 pattern.

No community discussion yet for this question.