Authenticating REST Users

Question

I'm working on extenral service that will use REST API. The service will make a login to Salesgforce every day and will run REST queries. From this article, it seems that I need to use OAuth2 - username&password flow as my authentication method:

Much like the SOAP APIs offered by Force.com, the REST API requires users to be authenticated before accessing the data or functionality within the Force.com organization. While it is possible to reuse the SOAP-based authentication token for REST service calls, a better option is to embrace one of the OAuth 2.0 authentication flows. In the scenario below, you will use the username-password OAuth authentication flow to pass credentials to Force.com and acquire a valid session token.

For OAuth 2.0, there is a need to create a connected App and insert more credentials parameters to my service (client key, client secret). So, before implement this solution, I want to understand why OAuth 2.0 is a better option.

Answer 1

The Username-Password flow is not recommended. See Understanding the Username-Password OAuth Authentication Flow:

This OAuth authentication flow involves passing the user’s credentials back and forth. Use this authentication flow only when necessary. No refresh token will be issued.

Instead, use the User-Agent flow if you can. As a common example, you can see this in action when you use the Workbench. The user grants access, then you are given a token that you can use to access the system.

This flow is secure because the client never handles a password. Also, it's easy to revoke access to a specific connection without having to reset the user's password, especially since there's no knowledge of the password on the client. Finally, it's more convenient for users, because access can remain granted, even when they change their username or password; the token is tied to the user's Id directly.

Also see Secure Coding Storing Secrets.

Salesforce.com Integrations

External applications should not store Salesforce.com user credentials (usernames, passwords, or session ID's) in external databases. In order to integrate an external application with Salesforce.com user accounts, the OAuth flow should be used. More information about implementing OAuth can be found at here.