Web

Question 1

Different REST API authentication?

Answer 1

Digital signature
Mathematical scheme to verify that the sender of the msg is who he is, also the msg is not modified during transit.

OAuth 1.0

1. based on digital signature framework
2. Transport independent
3. Each msg signed individually
4. If a single message within the communication is constructed or signed improperly, the entire transaction will be invalidated

OAuth 1.0

1. Transport dependent - delegate most security check to https
2. Centered around bearer tokens : These are easy for integration but not great for security. Bearer tokens do not provide internal security mechanisms. They can be copied or stolen but are easier to implement.
3. Easier : OAuth 2.0 is much more usable, but much more difficult to build securely.
4. Flexible : OAuth 1.0 only handled web workflows, but OAuth 2.0 considers non-web clients as well.
5. Better separation of duties : Handling resource requests and handling user authorization can be decoupled in OAuth 2.0.

Question 2

Difference between HTTP and HTTPs?

Answer 2

1. HTTP uses port number 80 for communication and HTTPS uses 443
2. HTTP is considered to be unsecure and HTTPS is secure, msg in HTTPS are encriped using SSL Certificates
   HTTP + Secure Sockets Layer - security protocol that create a encripied link between a server and client, so the data transmitted will be encrypted.
3. HTTP Works at Application Layer and HTTPS works at Transport Layer

Question 3

How SSL certificate works?

Answer 3

1. using public/private key mechanism
2. are provided from CA(certificate authority)
3. Digitally signed by the CA, this browser can filter out unknown signature

Steps

1. send my public key to CA,
2. CA created some data structure matching my private key(the certificate)
3. install that on my server

Question 4

What is FIX?

Answer 4

1. a electronic communication protocol
2. international real-time exchange of information related to securities transactions and markets
3. standard electronic protocol for pre-trade communications and trade execution.