So I'm trying to create and secure a mobile REST API on an existing server that runs our web app. We're not going to open the API to the public and we will be writing the client app using PhoneGap/Javascript/HTML. We could very well use HTTP Basic but I wanted something a little more advanced and secure. I do not want to use OAuth or Amazon's AWS security as those seem to be mainly for opening up your API to the public or a 3rd party.
I'm really new to REST APIs and security, but after doing some research I plan to use this implementation as written by Google. I'll sum up the general idea:
- User sends the server credentials through a secure POST
- If the credentials match. The server creates a token, saves it in the database, then sends it back to the user. The token will be based on the user's UUID and a timestamp.
- The database will store the last time the user changed their password and will only validate calls with tokens that were issued after that time.
- The user then sends this token in the header with each API call
How secure is this implementation? How do I stop brute force attacks on my authentication method? Any other suggestions or recommendations are appreciated.