Question

I have a RESTFull server and an Android client for it. The server has some methods that return data to HTTP calls of the client. One of the methods in the client code is the one shown below which I used to authenticate the customer.

        HttpClient httpclient = new DefaultHttpClient();
        HttpGet request = new HttpGet(
                "http://localhost:8080/myapp/customer/login/cUser/cpwd");

        request.addHeader("Accept", "text/plain");
        HttpResponse response = httpclient.execute(request);
        HttpEntity entity = response.getEntity();
        InputStream instream = entity.getContent();
        String msg = read(instream);


 if(msg.equals("success"){ // if customer logged in successfully
     //do something
 }

The Server side code uses part of the above uri as username and password and do the authentication. In my opinion, it is easy for someone to get access to these data and use it however he/she like. Is there a better way of doing this?

Thanks in advance

Answer 1

In a RESTfull service you have to use HTTP/1.1 auth headers, for example:

request.addHeader("Authorization", "auth string");

Auth string can be basic authentification string: base64_encode(login+":"+password) or OAuth2 auth token etc.

P.S. Ou bien use SSL connections, as Brian Kelly said.