I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL.
The Userid / Password is encrypted and sent to Web Application hosting the REST WS where the Application decodes it and Authenticates it.
Would there be any mechanism by which it can get hold of the UID / PSWD from Mobile App calling this REST WS or via a Client Browser ?
In order to prevent this , lets say I apply NONCE , where the Client calls to get Nonce Value and then attaches this to UID and Password ?
How do I secure the NONCE API over the web where browser or mobile can call it ?