I'm really new to REST APIs and security, but after doing some research I plan to use this implementation as written by Google. I'll sum up the general idea:
- User sends the server credentials through a secure POST
- If the credentials match. The server creates a token, saves it in the database, then sends it back to the user. The token will be based on the user's UUID and a timestamp.
- The database will store the last time the user changed their password and will only validate calls with tokens that were issued after that time.
- The user then sends this token in the header with each API call
How secure is this implementation? How do I stop brute force attacks on my authentication method? Any other suggestions or recommendations are appreciated.