Update a Socrata dataset using app token and private in HTTP basic

问题

I'm trying to write a script to update metadata on various datasets, using an authorized app. Using OAuth seems like the wrong approach (it's not a web-facing application for other users to use as themselves), and passing my own user name and password seems...icky.

The SODA API authentication documentation is pretty confusing:

All HTTP-basic-authenticated requests must be performed over a secure (https) connection, and should include an application token, which is obtained when you register your application. However, authentication [sic, should be "application"?] tokens are not strictly required when a request is authenticated. Authenticated requests made over an insecure connection will be denied.

Here is a sample HTTP session that uses HTTP Basic Authentication:

POST /resource/4tka-6guv.json HTTP/1.1
Host: soda.demo.socrata.com
Accept: */*
Authorization: Basic [REDACTED]
Content-Length: 253
Content-Type: application/json
X-App-Token: [REDACTED]

So:

1. Can you even use app token + secret token to authenticate with HTTP basic?
2. Which of the two "[REDACTED]" is the app token, and which is the secret token?

My guess (based on some testing) is that the answers are:

1. No
2. The first "[REDACTED]" is the Base64 version of username+password, the second one is the application token, which is not relevant to authentication.

回答1:

Application tokens and secret tokens aren't actually tied to any sort of pre-baked user authentication. They're tied to your application, and are then used in OAuth to ensure that your app is what it claims to be when the user is passed through the OAuth workflow. Once the user authenticates, the app can retrieve an authentication token that is used to actually authenticate their requests.

What you're really looking for is a way to retrieve a "bearer token", which some API providers allow you to generate. This would allow you to basically "pre-OAuth" and get an authentication token without going through the full workflow. Unfortunately we're not one of them (yet) so you'll need to authenticate with plain old HTTP Basic and your username and password.

If you want a slightly-less-icky way to do that, I recommend registering a "bot" account that you grant only the necessary permissions on the necessary datasets. Then at least you're not baking your regular user credentials into your config. But keep in mind that even if we had bearer tokens, you'd be putting those into your config somewhere.

To answer your more specific questions:

1. No, because then one of them would have to be a bearer token, which they are not.
2. The Authorization header is the Base64 encoded username:password, while the X-App-Token is your application token. In this case the latter is just an extra header that would identify that request as having come from your app.

Thanks for your feedback on the docs - I'll clean them up and try to be more straightforward, and I'll definitely fix that typo.

来源：https://stackoverflow.com/questions/40476917/update-a-socrata-dataset-using-app-token-and-private-in-http-basic