使用会话ID进行肥皂认证

Question

I am building an API using Zend Soap and there has to be some sort of authentication to actually use the API. Also I don't want the user credentials to be sent over the net each time a request is done.

Is it ok to do an post-authentication by using sessionids & something like this:

1. User authenticates himself once via SOAP and gets his serverside session id in return.
2. After that the User has to send his sessionid within the SOAP Header each time he requests something.
3. When I get an header containing a sessionid, I check the id against my sessionid_db and perform the request if everything seems alright.

Answer 1

Look into oauth? zend_oauth