How does REST API authenticate with username and password?

It requires client secret and other user specific details.

How does it protect against MITM attacks? If the device is not under our control, it will never be safe since anybody can spoof the headers.

Also are there any additional security features in REST APIs? Thanks. When you call an API endpoint, there is a header "Authorization" where you give your credentials. You have 2 ways of giving credentials: The Authorization header will contain a token. When your endpoint call sends this token to the API server, the API server compare it with a key stored in the database (the keys are also send in the headers as the header "x-api-key"). If it's equal, your server can consider the call authenticated. The server may validate the token by comparing the date given as date of token and the date stamp of the request (in case of tokens in headers).

You send your username and password in the body of the request. The server will compute (in real time) a hash of these credentials (based on a password hashing algorithm like bcrypt or sha512) and compare this with a key in the database (the same key as the server used for validating the token, but stored in a non-volatile way like a cookie or the session id).

This is very secure because no authentication can be done without using a key that is unique to the user. Also, the hash algorithm used is strong enough, so no hacker can guess it if he is not supposed to access to the system. The client secret used to compute the hash is usually set by the developer of the API server and must be used in production as the only source of secrets.

Using the HTTP Basic scheme is not secure at all. There are no more extra security measures than the standard HTTP request authentication and response checking by the REST API server (and the API server can handle a lot of malicious HTTP traffic).

What is basic authentication to username and password?

I'm new to AngularJS, and learning it.

I saw the basic auth examples, where username and password are being sent to the server side. Can you show me an example please? Thanks a lot for your help.

From your question, I believe the answer might be already given in your link. A way of accessing web applications which uses username and password authentication is called basic authentication. It has many variations, and the protocol may change over time.

Basic Authentication. For more information: Well in basic authentication is used simple HTTP method(GET/POST).

What is the basic authentication for REST API?

REST stands for Representational State Transfer.

It is a set of conventions that allow your clients to access the API through a web browser.

The basic authentication is used to provide client side security, to prevent client side attacks. It allows your clients to send a username and password over the wire. The server will then verify the credentials and accept or reject the request accordingly. If it accepts the request, it means that the user is authenticated.

REST is not limited to web browsers, it can also be used in native applications and even desktop applications through protocols such as SOAP or RPC.