title: Secure REST API without user authentification (no credentials)
body: <p>I've been struggling for 2 days now on how to secure a REST API without user authentification.</p>
  
  <p><strong>What does it mean ?</strong></p>
  
  <p>In my AngularJS application I identify an user by sending a GET request to an existing service (companydomain/userinfo) which I must use. I'm not sure how this work since I am not the author of this piece of code but the point is that I get the information about the user in the response as JSON (active directory name, phone in the company...).</p>
  
  <p>This is all I have to identify an user.</p>
  
  <p><strong>What I did</strong></p>
  
  <p>Now, I found a lot of resources talking about OAuth, unique token, etc. but nothing seems to match with my issue. I implemented a token system but it's plain useless since I can't be sure of the authenticity of the requester.</p>
  
  <ol>
  <li>User open the application. Application ask the service about the information related to the user. <em>companydomain/userinfo</em></li>
  <li>Application request a token to the server (nodejs &amp; express), based on the information returned. <em>/api/token/get/{user_info}</em></li>
  <li>Server generates an unique token and store it in memory with expiration date and owner. The server also check in the table "authorized users" if the user exists (based on the active directory name), if not a new entry is added to it.</li>
  <li>Application send the token along each request to the API. <em>/api/entry/delete/{entry_id}</em></li>
  </ol>
  
  <p>I think you see what is wrong here, an attacker could easily make a corrupted request to the API to get a legit token. So my question is :</p>
  
  <p><strong>How can I manage to secure my API since users don't use credentials to authentify ?</strong></p>
  
  <p>I hope my question is clear enough and at this point I am not even sure I can get around this issue without adding a credentials system. </p>