有哪些方法可以保护REST API？

Question

I have a situation where iPhone client Signs In with Google/Facebook

                   step 1
iPhone Client   --------——> Google/Facebook

Once Authenticated, client needs to get data from my REST APIs

                   step 1
iPhone Client   --------——> Google/Facebook
      |
      | step 2
      |
      V
  GET /transactions

Question

1. Since server is not aware if client is authenticated(Ideally client is authenticated), what are some ways I can secure my REST APIs to have confidence that it is reasonably secured against malicious attacks?

2. Also, I do not want to maintain user/passwords on server

Answer 1

You need to look into OAuth2, which is created to authorise user and allow access to secured resources. Here are some useful links for the same:

RFC:

http://tools.ietf.org/html/rfc6749

One link that can lead you wherever you want to:

http://oauth.net/2/

Answer 2

您可以为响应中的每个客户端生成一个密钥，然后当客户端再次访问服务器（在请求中提供密钥）时，请比较该密钥在密钥池中是否为有效密钥。