I have a website with an already-established authentication system. Once a user logs on to it, one of the features is a statistics application based on AngularJS.
The app communicates with an external REST API (built on Spring) that basically just provides 3 functions:
- Receive a GET request, prompting it to retrieve the requested statistics from a database and send them back to the front-end application
- Receive a POST request, allowing users to save a few configurable options into the same database. So the options table in the DB would hold the user ID of the requester and several optional values
- Receive a GET request to retrieve those options at a later date
Security-wise, the website and application front-end are covered, but I now need to secure the web service and, due to lack of knowledge of the subject, I cannot figure out the best method.
I basically need to make sure that any requests to the web service come from an authorised source (i.e. an authenticated user of the website) and also that any requests involving user-specific info (points 2 and 3 above) actually came from that user.
Note that it doesn't have to authenticate against some configured list of users on the the web service side, but if a request arrives saying "give me user1's options", it has to be user1 who is requesting that.
Options I've investigated so far:
- SAML - Which seemed like a good fit initially but doesn't really seem applicable to REST web services after all
- HMAC - Could I make the application send a key based on some combination of the user id and web application id that could only be decrypted with a salt at the web service end? So when it is decrypted, the application id can be confirmed and also it can be verified that the user id in the encrypted key matches whatever was passed in the "userid" parameter of the request?
- SSL - Am I just overthinking this whole thing? Could I simply use a certificate in the web application that is trusted by the API and therefore confirms that the request came from the application and could not have been manipulated in any way?