Web REST API的体面但简单的身份验证

Question

Let's say I have some Web API and I want it to use only the users who know the password. And I have a URL like this:

GET http://api.example.com/v1/dog/123

I don't need to much security here. So, it is secure enough to just supply a password like this:

GET http://api.example.com/v1/dog/123?password=myPassword

Of course, it's a plain text and a GET request which is not secure at all. But I can't use https for now (if it would help).

What are the other option for decent but not complicated authentication?

Answer 1

It seems that an explicit user login would be in order. Once the user is authenticated, authentication cookies in the GET request allow access the resource.

If you web service is in Java, the J2EE container takes care of all this for you. See the following tutorial: http://docs.oracle.com/javaee/6/tutorial/doc/gkbaa.html . To sum this up, the application server provide protection on a per-resource basis. The server also allows you to chose from multiple methods of authentication (form, basic, ...).