Android客户端和Grails RESTful服务的用户登录架构

Question

Unfortunately I haven't any tried and tested code for this, simply because I think there may be various ways to do this, but I am simply looking advice on which is best, as security and authentication is not my strong point.

I wish to have initially 2 clients - an android app and a grails based web client, both hitting grails RESTful web services. I have REST resources currently returning some data from the domain when using the web client, next step is to get the same data back into the android app. At the same time I want to integrate some user authentication so that the user must be logged in in order to receive back this JSON data from the REST layer.

In the past I have used Apache Shiro when creating a grails app when only using the grails web based client, is it possible to do the same with an android ap as the client?

Answer 1

In my Grails project with web/android front-ends I'm using for android auth a slightly extended version of SPRING_SECURITY_REMEMBER_ME token (yes, I'm using spring-security-core ++ plugin). This fits well in the application, is an easy to implement, tried and tested solution.