java web service: how to identify user

Question

I'm new to java and I'm trying to understand the way we identify users who uses webservices.

The program will be downloaded from my website. It needs to make a connection to my server side web service program.

I think there are 2 options for identifying the user:

1. Register on website and download web service. A single user id key is then generated when downloading the program. I don't know if this is possible + verification of registration can only be done by email: not 100% sure of user identity.

2. Download web service and log in into it. This seems a better way, but I'm not sure this is the way to do it...

Answer 1

Most services use HTTP authentication because the surrounding HTTP protocol already brings all the necessary features. Actually, your web service framework comes with all the plumbing necessary to easily set this up.

Another solution is to have a method which is called login() that takes a user name and a password. All other methods return errors until login() has been called successfully once.

Note that you must use HTTPS as protocol, otherwise passwords will be transmitted either as plain text or with a trivial encryption that is easy to break. Or to put it another way: Without HTTPS anyone willing to invest a couple of minutes of time will be able to use your service.