I'm newbie of web services programming and I have some problem to understand how to work authentication/security for REST WS pattern.
I had read about OAuth but I haven't understand how it work in detail, however I think I don't need it because only my app use the API.
I need authenticate the users that need to use the "privates" APIs, can you explain me the correct way for implement a REST WS authentication, or give me a good guide or flowchart?
According to the stateless constraint of REST, you cannot maintain sessions on server side. You have to authenticate every request instead.
There are 2 kind of clients:
By a trusted client the simplest solution to send the username and password with every single request. For example by basic HTTP auth in a HTTP header. (Ofc. with encrypted connection.)
Since your user cannot trust 3rd party clients with her password, you have to find out something else by there. A typical solution (e.g. facebook) to add a unique API key to each of the 3rd party clients. After that when the user wants to use one of them, she gets a prompt. Using that prompt she can grant access to the 3rd party client to use some part of her account. During this process the accessToken, userId, apiKey, permissions are saved on the server and the 3rd party client gets an access token for the user. After that the 3rd party client can use the access token (along with the API key and user id) to use the web service utilizing the account of the user.
