Google's Mobile Authentication for REST APIs

Question

So I'm trying to create and secure a mobile REST API on an existing server that runs our web app. We're not going to open the API to the public and we will be writing the client app using PhoneGap/Javascript/HTML. We could very well use HTTP Basic but I wanted something a little more advanced and secure. I do not want to use OAuth or Amazon's AWS security as those seem to be mainly for opening up your API to the public or a 3rd party.

I'm really new to REST APIs and security, but after doing some research I plan to use this implementation as written by Google. I'll sum up the general idea:

• User sends the server credentials through a secure POST
• If the credentials match. The server creates a token, saves it in the database, then sends it back to the user. The token will be based on the user's UUID and a timestamp.
• The database will store the last time the user changed their password and will only validate calls with tokens that were issued after that time.
• The user then sends this token in the header with each API call

How secure is this implementation? How do I stop brute force attacks on my authentication method? Any other suggestions or recommendations are appreciated.

Answer 1

The security of this solution depends on the security of two elements:

• The connection: If you're using SSL then the problems linked to connection security are well understood (if not always easy to evaluate): client-side root store quality, proper key exchange, use of secure protocols, etc.

• The token itself. First, it needs to be generated in a way that makes it difficult to guess and impossible to reuse. It also needs to be protected while on the client system (this is more of a problem in a web application than on a dedicated client but needs to be mentionned).

Assuming that both aspects of the problem are properly handled, then yes, such an implementation is pretty secure.