Question

I am developing several RESTful API for 3rd party to call, and these API need authentication (apikey & secret based), and authorization (HTTP method & URI based).

Are there any existing software we can reuse that prevent me from rolling out our own implementation for the security layer?

Answer 1

HTTP gives you granted support for that, so you don’t need to reinvent the wheel

Either use:

• HTTP Auth Basic (with SSL to bypass plain-text password submit problem)
• HTTP Auth Digest

Auth Digest has advantage, that it does not transmit the passowrd in cleartext and handles replay attacks (with nonces).

We use HTTP Auth Digest (Tomcat servlet container has direct support for it) and we are content with it.

EDIT: Some clients have problems with Digest (not so trivial), so these days I would opt for Basic and SSL. Advantage for Basic is also that you can you preemptive authentication (sending user:pwd in first request).