Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We develop social-based applications for mobile. Every application consumes RESTful API web-services. When I implement login I usually store the username and password somewhere on device. Then I send them and as a response I get access to my profile. But I also know there's another way to do this.

One somehow generates a token with a particular algorithm, and then send it instead of the username and password to gain access.

How should I implement that? Should I send this token along with every other request than login?

share|improve this question
That's authentication, not authorization. Authentication = prove that you are who you say you are. Authorization = prove that you are allowed to do what you requested. – tdammers Jan 15 '13 at 12:47
up vote 8 down vote accepted

There are several way how to implement authorization in RESTful context, and it is more safe to send only tokens instead of login/password: you could easy make tokens to be invalid by timeout or by some other criteria, and ask user to re-authenticate.

For example authorization REST requests using HMAC. In this approach, client will have public and secret keys. To all requests that require authorization, you should add publiс key, and use secret key to calculate hash of your request

var myRequest = "https://myserver/resource?publicId=12345&param=value";
var requestHash = hmac_implementation(myRequest);
myRequest = myRequest + '&hmac=' + requestHash;

Now server could identify request by public key and calculate requestHash itself. If both hashes are equal, then user is authorized.

Btw, you also have to use https to secure communication over a computer network — this will dramaticaly reduce number of possible problems.

share|improve this answer

oAuth is the standard for this but there are more solutions.

Don't try to implement security, tokens etc. all by yourself since that's a difficult and risky topic. Take for example a look here:

share|improve this answer

its simple , just use cookie's, in first user request for token in login form and after it when get the token with permissions , in back-end check token from cookie before handling any requests,

share|improve this answer
Could you explain a bit more on the answer? How is it simple? How do the cookies help? How is this superior to other forms of authentication? are there any downsides? How would an API based one that has authentication but no login page work? – user40980 Mar 16 '14 at 21:47
just create a some models on server side for user,role,user_role,user_perm,role_perm ,perms and session,sesion_perm models in server-side and use cookie for saving token , check every request about having Token from cookie and when user isn't login just send 401 Status Code in header and when user haven't permission to the object send the 403, finally check response of request in client side for example I'm using backbone.js for the client side : $.ajaxSetup( { statusCode: { 401: function({window.location.replace('/#login');}, 403: function({window.location.replace('/#denied');} } } ); – Siamand Maroufi Mar 17 '14 at 17:54
Could you put that into the answer? As an aside, I would strongly suggest running the resulting answer through – user40980 Mar 17 '14 at 17:55
for client side: $.ajaxSetup( { statusCode: { 401: function({window.location.replace('/#login');}, 403: function({window.location.replace('/#denied');} } } ); – Siamand Maroufi Mar 17 '14 at 18:02
Please put this into the answer rather than comments. Comments do a very poor job of formatting source code and aren't easy to search on. – user40980 Mar 17 '14 at 18:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.