Best Way To Authenticate Restful API and Mobile App

Question

I google search many time about how to authenticate Restful API and Mobile App. I found a lot answers but I feel not better, or perhaps because I am new in API.

My Willing:

Mobile App request or post data to Restful Server
Restful Server Authenticate Mobile App by Username And Password Login
I want to secure on Restful Server And avoid hacker steal password and request data.

After searching by google they told:

use Https with SSL
authenticate username or password then generate new token and signature
use token and signature to authenticate Mobile App.
Other way use Oauth 2.0. After reading Oauth 2.0 document,

I still think its structure still similar token and signature above.

I think if like that, mobile app can store or use token and signature, or hacker can debug or see process log in by proxy request. I feel still not secure because we still use token and signature on requesting.

I just start my new knowledge in API. If I misunderstand, I am sorry. I use PHP coding.

Boris Pavlović · Accepted Answer · 2016-11-07 09:49:06Z

1

I would recommend jBoss's Keycloak (http://www.keycloak.org/). From the first page:

Add authentication to applications and secure services with minimum fuss. No need to deal with storing users or authenticating users. It's all available out of the box.

You'll even get advanced features such as User Federation, Identity Brokering and Social Login.

For more details go to about and documentation, and don't forget to try Keycloak. It's easy by design!

answered Nov 7, 2016 at 9:49

Boris Pavlović

64.9k29 gold badges127 silver badges150 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Best Way To Authenticate Restful API and Mobile App

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related