Building a new Application: Java jax-rs ee6 restful web service with a html5 front-end using backbone.js

Question

We are currently evaluating building a new web-application which consists of the following technology:

Back-end: ee6 jax-rs restful web service

Front-end: html5 UI using backbone.js (and various other libraries)

The question is, what is the best way to implement a secure session? Limitations are we cannot use oAuth (due to legacy login service we will be consuming). We need a financial industry level of security.

We are thinking about using HTTPS basic authentication with the rest server (back-end), and use backbone.js's session to elegantly handle the front end.

What are the security implications of adopting this strategy?

Answer 1

When you approach security issues, you must remember that your security is as strong as your weakest link. I hope you fully realize you need to secure all your communication, and not just the login.
Also, what key length are you going to use? 128bit?
I would recommend you to check about SPEGNO .. I think this might assist you.