I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality pre-made security modules like, for example, Rails' Devise, and thus I have to roll my own. I also think this is a very good learning opportunity, so why not.
The basic scenarios I need to have working are:
- secure login through the web
- login for mobile users using the same API
- ACLs based on who the user is
Having never implemented any of the above by hand, I don't quite know the best practices. I've unfortunately been unable to find any good resources that would have tutorials/guides on how some of these basics form of web security are implemented.
For example, what is a good example of cookie-based authentication, what do you store in the token that's left on the user's browser etc etc. I've failed to uncover anything solid through Google, surprising given that it must be one of the most common implementations for most websites.