I am currently working on a service which offers a HTTP API for mobile clients.
I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be no external providers. Connection itself is encrypted through SSL/TLS.
My question now is which mechanism I use after user credentials where checked. As far as I know the most common are:
- HTTP basic authentication
- HTTP digest access authentication
- Session based authentication
I personally tend to stick with the session based authentication as it is widely supported and easy too use - also it seems me quite secure (okay there is session hijacking but you do not have to resend your credentials every time)
However would it be an improvement to switch to HTTP digest access authentication or even OAuth?