Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

This questions is with respect to including security in our architecture.Let me give a brief over-view.

We have REST based web-service (Let's call it A) which is used by our web application and the iPhone app. A internally makes call to web-service A1 and A2. We also have couple of web-services B and C which run along side with A. i.e. our web application also relies on B, C.

A, B, C needs to know the user state so that web app works well but also can run independently in case any service is required by mobile app respectively.

Currently as the application was in alpha phase, no security exists at any level. We are having a tough time introducing security now.

This is what I have tried:

  • Using spring-security introduced a login/logout page for A where the session is managed. A rest call is rejected if no session was found to exist. This works out well for web-app but doesn't go well if any other application needs to make rest calls to A.

This doesn't feel nice as having a session for a rest-ful service neither makes it completely rest based nor the conventional web app. Also the development is a pain for UI developers, as they to artificially add cookie while sending requests for development purpose.

Another alternative would be: Making Rest service secured using OAuth or amazon S3 type security. But what about state-management then?

Can someone share their experience on it?

share|improve this question
Have you looked at the following post: stackoverflow.com/questions/4817643/… –  Liam Sorsby Feb 3 at 12:25
@LiamSorsby Thanks. But the issue is not of security for Rest based web-service but how also to manage state so that it can be used by web app and truly rest based. –  Jatin Feb 3 at 12:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.