Authentication in RESTful Java web service for mobile clients

Question

I have found numerous academic answers to this question, but I would like one from practitioners in the field.

Background

I would like to create a Java-based RESTful API, using the Grails framework for a variety of mobile clients (iOS and Android) to access protected resources through my service. I require authentication on certain requests, and I already have SSL setup over the wire (so all requests occur over https). My web API will eventually be exposed as a service to other web applications.

Problem

What authentication method do people recommend for a web service that is to be consumed by mobile devices, and eventually other web applications?

These are what I see as my choices. Can you tell me when would be appropriate use cases for each one?

1. I can do HTTP Basic authentication
2. I can do HTTP Digest authentication
3. I can implement OAuth authentication (1.0 or 2.0)?
4. I can pass the credentials as parameters in my request
5. I can use an authentication method above, and then pass a delegate/token around for authentication
6. I can implement my own custom HTTP authentication headers
7. I can use cookies and pass those to the server on each request
8. Other...?

Need

If you have one leaning one way or another, I'd like to know why you would choose that method. Better yet, if you're doing this in Grails, I'm very interested.

I already know...

I've already read through the excellent answers here and Richardson and Ruby's book, Restful Web Services.

Answer 1

REST is stateless protocol, thus using "work sessions" - I mean login/work/(auto)logout concept is somewhat questionable. Sending credentials as a parameter with each request seems to be the most often used method due to its simplicity. Just keep in mind that

1) The api url must be SSL only - it makes sense to use a dedicated domain AND ip address, e.g. api.example.com and configure your web server to handle SSL only for this address and domain. Just to avoid accidental disclosure of credentials.

2) Avoid using login/password with the request if possible, use "API key" (a shared secret) instead. You always may use "API key" instead of login/password if authentication is all you need, that is you do not need authorization (all users share the same permissions) and no need for logging (who did what).

3) Rather than sending the API key with each request, it is better to "sign" the request using shared secret and supply the signature. With the key long enough you may use this technique over plain unencrypted http.

=== responding to a comment ===

If you need authorization, just use basic authentication:

HTTPBuilder builder = new HTTPBuilder("https://api.example.com/v1/foo/bar")
builder.auth.basic(login, password)
builder.headers.put('Accept', 'application/json')
def result = builder.request(POST, JSON) { req ->
     body = [
                ....
            ]

     response.'201' = { resp, json ->
                ....
     }

     response.success = { resp, json ->
                ....
     }

     response.failure = { resp ->
                log.error "failure, ${resp.statusLine}"
     }
}