How to approach securing webservices? I can think of using one of the two approaches below
- sending a user name password in every request for validation
- Sending a time based token (GUID or some similar long string)
In the first approach I have to query a database every time in most cases an RDBMS to authenticate a user.
In the second I now make a user name password authentication only once and then return to the user a time based token. All future business requests are authenticated via this token. On expiry this token will need to be recreated by the calling client.
Both approaches seem to have their own pros and cons. Which one would you recommend in which circumstances and what would be your reasons for the same? Perhaps a specific condition where one favors the other.