Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently working on a service which offers a HTTP API for mobile clients.

I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be no external providers. Connection itself is encrypted through SSL/TLS.

My question now is which mechanism I use after user credentials where checked. As far as I know the most common are:

  • HTTP basic authentication
  • HTTP digest access authentication
  • Session based authentication
  • OAuth
  • OAuth2

I personally tend to stick with the session based authentication as it is widely supported and easy too use - also it seems me quite secure (okay there is session hijacking but you do not have to resend your credentials every time)

However would it be an improvement to switch to HTTP digest access authentication or even OAuth?

Best, Bodo

share|improve this question
up vote 1 down vote accepted

For mobile clients the potential problem with session based authentication is that you probably have to have very long session timeouts, as users typically don't like entering their credentials every time they use an application.

At that point, whether that's acceptable might depend on how you're restricting the use of the Session ID. If all it can do is take relatively non-sensitive actions then it might be a reasonable solution (not really that different to an OAuth access token), but one concern might be if an attacker gets access to that token he can take security sensitive actions like changing the users credentials.

At that point you might want to consider OAuth or something similar to restrict the actions that a specific token stored on a mobile device can take.

One other point to mention about HTTP basic or digest is that using them gives you the headache of storing the users credentials on the client.

share|improve this answer
Thank you for your answer. I think I will stick with sessions with a small timeout (retyping credentials would be an acceptable off-point) – bodokaiser Aug 25 '13 at 7:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.