Login/Register by using RESTFul api written on Jav

问题:

I have created Java Web Application by using Netbeans IDE. I have created entities with relationships. Webpages are simple dashboards where I can add new entities, change them and delete them.

I have added Restful web services to my entities. So web page will be available only for admin and I want to create client application that will have access only for his own data. That means client must login or register to my server.

When user logins/registers on website, server will create session for this user. I know that in RESTful service there is no sessions. My thought is to pass login and password every time when client wants to do some operation with server.

Question: is there any other method to create something like session between client and server? I hope it is not connected with encryption.

回答1:

There are many options for authentication as well as authorization. If you want to use simple authentication then 'Basic Auth' of HTTP. Check out http://tools.ietf.org/html/rfc2617 for details. Remember that this is unsafe because the username/password flows on wire. Anyone can sniff username/password. This is updated by new RFC7235 - http://tools.ietf.org/html/rfc7235#section-4

Safer choice is oAuth. Explained in RFC6749 https://tools.ietf.org/html/rfc6749. In this case an access token goes with each request.

In both the cases the credential details travel with headers. No interference with parameters.