I'm implementing a REST-style (note: it needs to be more pragmatic than canonical) web API and I would like to secure it. The language I'm using is rather fresh and doesn't have a lot of high quality pre-made security modules like, for example, Rails' Devise, and thus I have to roll my own. I also think this is a very good learning opportunity, so why not.

The basic scenarios I need to have working are:

  • secure login through the web
  • login for mobile users using the same API
  • ACLs based on who the user is

Having never implemented any of the above by hand, I don't quite know the best practices. I've unfortunately been unable to find any good resources that would have tutorials/guides on how some of these basics form of web security are implemented.

For example, what is a good example of cookie-based authentication, what do you store in the token that's left on the user's browser etc etc. I've failed to uncover anything solid through Google, surprising given that it must be one of the most common implementations for most websites.


Thank you!

1 Answer 1


Most of the OWASP top 10 still applies to web services. A more detailed resource would be the Mozilla WebAppSec Guide.

"RESTful" web services should not have a "session token". Related: "Do sessions really violate RESTfulness?" However at the end of the day you need a some kind of token for authentication purposes.

In short, if you are writing a session handler to solve a real world problem you are doing it wrong. The last thing we need is yet another reinvention of the wheel. If you are writing a session handler for the purposes of education, then that is a great learning tool! The Mozilla WebAppSec Guide and the OWASP Session Management Cheat Sheet have detailed requirements for a secure session handler.

  • Those are all great links, thanks a bunch. Regarding your last paragraph, isn't it a matter of evaluating the cons and pros, based on the situation? For example, if you're using a somewhat obscure technology for implementing your web app, you pretty much have to roll you own session management. That's why I was hoping not to have to "reinvent the wheel" and instead follow the best practices out there to try to get to the same result, except implemented on my own. Yes, it might not be bank-bulletproof right away, but perhaps for certain low-importance data it might be acceptable?
    – glitch
    Commented May 3, 2013 at 20:24
  • @glitch if such basic tools are not available then its probably not the right platform for a production system.
    – rook
    Commented May 3, 2013 at 20:57
  • Make sense, thank you for taking the time to write everything up!
    – glitch
    Commented May 3, 2013 at 21:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .