Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I am working on a set of REST APIs that needs to be secured so that only authenticated calls will be performed. There will be multiple web apps to service these APIs. Is there a best-practice approach as to where the authentication should occur?

I have thought of two possible places.

  1. Have each web app perform the authentication by using a shared authentication service. This seems to be in line with tools like Spring Security, which is configured at the web app level.

  2. Protect each web app with a "gateway" for security. In this approach, the web app never receives unauthenticated calls. This seems to be the approach of Apache HTTP Server Authentication. With this approach, would you use Apache or nginx to protect it, or something else in between Apache/nginx and your web app?

For additional reference, the authentication is similar to services like AWS that have a non-secret identifier combined with a shared secret key. I am also considering using HMAC. Also, we are writing the web services in Java using Spring.

Update: To clarify, each request needs to be authenticated with the identifier and secret key. This is similar to how AWS REST requests work.

share|improve this question
Can you clarify what you mean by Authentication in REST API Server? REST is stateless, so you don't authenticate only at the beginning of communication. If you meant authenticating every request, then usually it's only a simple function call. –  imel96 Jul 16 '13 at 6:34
I added an additional note that each request is authenticated. –  David V Jul 16 '13 at 14:54
add comment

1 Answer

The greatest concern IMHO is ease of use by developers, so assuming you are publishing an SDK or library as a compliment to your API, you can secure a client's calls any number of ways provided you keep it simple for the developer. But perhaps that is obvious?

That being said, I think the most straightforward way is HMAC. That gives you both the means to authenticate, but also the means by which you can verify the integrity of the message contents/payload. Plus, it is a common enough approach whereby most developers can find plenty of sample code to implement it for virtually any platform.

The question I might ask of you in return is, what is the data you need to secure? Are there any kind of industry standards you should conform to?

Otherwise, HTTP Basic auth over HTTPS only, or simply passing in a username/password parameters along with the request over HTTPS only might be sufficient (knowing full well though that this is not the most secure form of auth holistically speaking). Knowing that, if this is insufficient to your customers, you can always add additional forms of authentication down the road.

share|improve this answer
thanks for the response. I have a fairly good idea of how I'd like the authentication scheme to work. What I'm wanting to know, is where on the server should the authentication verification occur. Within each webapp, or before the webapp is called? –  David V Jul 19 '13 at 18:35
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.