I'm working on a RESTful API, that works as backend for a mobile application.
The underlying system is based on Jersey and Jetty server, but my question is more generic (for any JaX-RS compliant system).
I'm looking for a standard solution to secure it. I read about many answers talking about JWT, tokens, ... and OAuth.
But all solutions except OAuth do not have a Standard and neither any implementation apart from some basic examples on github.
I'm concern as OAuth seems a good solution for third party access on your API but I think is a great overhead for straight access & tokenization, from a Mobile app or a Website AJAX. Is hard for me to accept that is the only available solution.
Here I'm asking, am I wrong about OAuth (beeing designed for third party access)? or other access solutions are not available (eg opensourced) as they are only custom made for the specific purpose?
My scenario requirements:
Token should be self certified (eg JWT) so a proxy/load balancer can filter out a not signed one, before reaching the endpoint.
No need for a token/renew system as we have a distributed cache holding a SESSION and therefore a missing session mean that authorization expired/was revoked.
The second one, may not be true as if we issue a certificate to an App for 1 year, and revoke it after 1 hour. This token may be still used by an attacker to "frustrate" our cache for 1 year.
