What mechanism to use for simple and secure HTTP API access?

Question

I am currently working on a service which offers a HTTP API for mobile clients.

I want clients to authenticate in order to access my API. The server itself is doing the authentication there will be no external providers. Connection itself is encrypted through SSL/TLS.

My question now is which mechanism I use after user credentials where checked. As far as I know the most common are:

• HTTP basic authentication
• HTTP digest access authentication
• Session based authentication
• OAuth
• OAuth2

I personally tend to stick with the session based authentication as it is widely supported and easy too use - also it seems me quite secure (okay there is session hijacking but you do not have to resend your credentials every time)

However would it be an improvement to switch to HTTP digest access authentication or even OAuth?

Best, Bodo

Answer 1

For mobile clients the potential problem with session based authentication is that you probably have to have very long session timeouts, as users typically don't like entering their credentials every time they use an application.

At that point, whether that's acceptable might depend on how you're restricting the use of the Session ID. If all it can do is take relatively non-sensitive actions then it might be a reasonable solution (not really that different to an OAuth access token), but one concern might be if an attacker gets access to that token he can take security sensitive actions like changing the users credentials.

At that point you might want to consider OAuth or something similar to restrict the actions that a specific token stored on a mobile device can take.

One other point to mention about HTTP basic or digest is that using them gives you the headache of storing the users credentials on the client.