I am planning to secure my REST Web service (REST WS) using API KEY and NONCE VALUE. The REST WS is over SSL.

The Userid / Password is encrypted and sent to Web Application hosting the REST WS where the Application decodes it and Authenticates it.

Would there be any mechanism by which it can get hold of the UID / PSWD 
from Mobile App calling this REST WS or via a Client Browser ?

In order to prevent this , lets say I apply NONCE , where the Client calls to get Nonce Value and then attaches this to UID and Password ?

How do I secure the NONCE API over the web where browser or mobile can call it ?
  • 1
    Use the OAuth 2.0 protocol instead to secure you API. the open standard of OAuth 2 provides a secure and open source method to authenticate and track applications making requests to your REST WS. – TMR_OS May 6 '14 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.