This questions is with respect to including security in our architecture.Let me give a brief over-view.
REST based web-service (Let's call it
A) which is used by our
web application and the iPhone app.
A internally makes call to web-service
A2. We also have couple of web-services
C which run along side with
A. i.e. our web application also relies on
C needs to know the user state so that web app works well but also can run independently in case any service is required by mobile app respectively.
Currently as the application was in alpha phase, no security exists at any level. We are having a tough time introducing security now.
This is what I have tried:
- Using spring-security introduced a login/logout page for
Awhere the session is managed. A rest call is rejected if no session was found to exist. This works out well for web-app but doesn't go well if any other application needs to make
This doesn't feel nice as having a session for a rest-ful service neither makes it completely rest based nor the conventional web app. Also the development is a pain for UI developers, as they to artificially add cookie while sending requests for development purpose.
Another alternative would be: Making Rest service secured using OAuth or amazon S3 type security. But what about state-management then?
Can someone share their experience on it?