What mechanism to use for simple and secure HTTP API access?
I am currently working on a service which offers a HTTP API for mobile
clients.
I want clients to authenticate in order to access my API. The server
itself is doing the authentication there will be no external providers.
Connection itself is encrypted through SSL/TLS.
My question now is which mechanism I use after user credentials where
checked. As far as I know the most common are:
HTTP basic authentication
HTTP digest access authentication
Session based authentication
OAuth
OAuth2
I personally tend to stick with the session based authentication as it is
widely supported and easy too use - also it seems me quite secure (okay
there is session hijacking but you do not have to resend your credentials
every time)
However would it be an improvement to switch to HTTP digest access
authentication or even OAuth?
Best, Bodo
No comments:
Post a Comment