Home/ Questions/Q 104415
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T01:16:41+00:00

I’m going to be developing a REST-ful Web Service for a new public website.

  • 0

I’m going to be developing a REST-ful Web Service for a new public website. The idea behind the web service is to have 3rd parties develop fully functional UIs for the business logic.

For security reasons, I’d like to avoid users having to give their passwords for our service to the 3rd party applications. (Perhaps this shouldn’t be a big concern?) Instead, I’m looking to implement some sort of login system on our site that provides an auth token to the 3rd party app but keeps the actual password out of their hands.

This made me think that OpenID might be a potential solution here. It seems to me that it should work: the actual password is handled by the OpenID provider and so it doesn’t rest with the 3rd party app. I think that the trouble would probably lie with the various passthroughs, but that should be manageable.

However, there’s a surprising lack of Googleable info on this, so I’d like SO’s opinion. Has anyone implemented a similar system before? Is it even possible? Is it worth the trouble?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. I agree completely that what you want is OAuth; I say that having worked on both OAuth and OpenID systems. I’ve also been in your boat a few times, having to develop a REST web service api.

    For a really good ideas on OAuth, and why it is what you want see these attached article:

    These are must read, there are four parts read them all: http://hueniverse.com/oauth/guide/

    the RFC, read after reading above as it can be a little daunting for most: http://oauth.net/core/1.0

    And then finally maybe some code. I have a couple projects hosted that are using Java/Groovy to do OAuth. One is a plain old OAuth client, the other is a client for specific interactions with NetFlix. http://www.blueleftistconstructor.com/projects/

    If you are relatively inexperienced with REST (you haven’t built a full scale web api yet) I would recommend that you buy (or better get your boss to) ‘RESTful Web Services’ by Richardson & Ruby. It is an O’Reilly book. I can say that it is one of their better books to debut in the past few years.

    It might also help to look at some RESTful OAuth based APIs. The NetFlix API is a perfect example: http://developer.netflix.com/docs

    Good luck and happy coding!

    • 0