I'm creating a simple Android application which requires reading and writing values to the cloud. I intent to use PHP for the webservice.
But I'm a little confused over the authentication scheme. I intent to host a script at www.mycoolsite.com/magic.php
and POST data to it from Android.
What is the best way to authenticate a user with the server, should I send the username and password with every HTTP POST (encrypted)? Also, if there are large number of users using the same script at a time, will there be some concurrency and efficiency issues?
- I understand that I can use REST to generate tokens, but I don't know how this works to generate the token. Do I need to send the username and password to the server once?
- So if an intruder gets hold of this token, can't the intruder send bogus requests. Is this token encrypted?