How does OAuth strengthen REST API security compared to BasicAuth?
Short answer
A Token
Question
Key Takeaways
The exam tests understanding of OAuth's token-based authorization model versus BasicAuth's credential-passing approach, with the common trap being confusing the transport-layer security (SSL/TLS) with the authorization mechanism itself.
OAuth strengthens REST API security by using access tokens instead of sending user credentials with every request, unlike BasicAuth which transmits username and password in each call. The community consensus confirms tokens as the core differentiator.
Common mistake: Option B (SSL) or D (TLS) is often chosen by candidates who conflate transport encryption with the authorization mechanism, failing to recognize that both BasicAuth and OAuth can use SSL/TLS equally.
Expert Analysis
Why the Answer Is Correct
OAuth fundamentally replaces credential transmission with short-lived access tokens (bearer tokens) issued after initial authentication. These tokens are scoped, revocable, and do not expose the user's actual password to the resource server. Community comment [2] clearly explains that tokens eliminate the risk of credential interception on every subsequent API call, which is the primary vulnerability of BasicAuth.
Why the Other Options Are Wrong
Options B (SSL) and D (TLS) are transport-layer encryption protocols that protect data in transit; both BasicAuth and OAuth can and should use them, so they do not differentiate OAuth's security model. Option C (Authentication) is incorrect because both BasicAuth and OAuth perform authentication — the key distinction is that OAuth uses token-based authorization for subsequent requests rather than re-sending credentials.
Community Comment Notes
Comment [1] concisely captures the core distinction: BasicAuth sends username/password, while OAuth sends tokens. Comment [2] provides the most thorough explanation, highlighting that tokens are issued post-authentication and used for all subsequent requests, reducing credential exposure risk. All voters (100%) correctly selected option A, indicating strong community alignment.
Official Reference
- https://oauth.net/2/
- https://datatracker.ietf.org/doc/html/rfc6749
- https://developer.cisco.com/docs/iox/#!authentication-and-authorization/oauth-2.0
These links open the official vendor documentation in a new tab.
Exam Strategy
When comparing authentication mechanisms, focus on what is transmitted in each API request rather than transport-layer protections. Remember that OAuth's primary security advantage over BasicAuth is token-based delegation, not encryption — SSL/TLS applies to both equally.
Community Votes
100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
slacker_at_work 👍 3 Answered AOAuth uses tokens to strengthen REST API security compared to BasicAuth. With BasicAuth, the user's credentials (username and password) are sent with each request, which poses a security risk, especially if intercepted. In contrast, OAuth issues tokens (access tokens or bearer tokens) to clients after successful authentication, and these tokens are used for subsequent requests.
-
chiacche 👍 3 Answered ABasicAuth -> username & password. OAuth -> tokens.
-
Mizuchan 👍 2 Answered ACorrect
-
supershysherlock 👍 1 Answered AAnswer A is correct.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 350-401 Questions
Access 218 questions with complete answers and detailed explanations.
View Full 350-401 Practice Test →