title: Recommended configuration for both web client and mobile REST api security
body: <p>I realize there are a ton of questions on this subject, and I have been researching this for a couple days now. I want to make sure my question is as specific as possible since I have yet to gain a full understanding of the best approach.</p>
  <p>Currently I have a developed django site, with the web client communicating probably about 95% via a django-piston json REST api. The other 5% is some remaning login functionality that still goes through POST forms with CSRF protection. Ideally I would like to move the remainder also into the REST api.</p>
  <p>I am at the point now where I need to figure out the best recommended solution for securing both the web client and the mobile client (app yet to be developed) in a reusable and happily co-existing fashion. I have read many posts ultimately recommending OAuth2 (and https) for the mobile side, but I am still confused about how to go about setting up the web client security. I am also grasping at understanding the OAuth2 aspect and whether I can use the 2-legged form. As it stands, the web client is django authenticated. Technically the jsonp functionality is still active in piston, so I would think anyone could use the api from a 3rd party app as long as their web session has the auth cookies?</p>
  <p><strong>Summary of the usage of my api:</strong></p>
  <ol>
  <li>The API is a completely private interface to the server app</li>
  <li>It would be ideal if the API could not be widely reused by 3rd party web client mashups.</li>
  <li>The data is not necc sensitive. Its just a social-type site with the most personal information being the basic user profile stuff like emails, addresses, etc.</li>
  </ol>
  <p><strong>Summary of my questions:</strong></p>
  <ol>
  <li>Is OAuth2 the best recommended approach to securing the mobile apps access? Does it have anything to do with the web client aspect? And if OAuth2 is recommended, should it be an application-wide key that is versioned with the app releases?</li>
  <li>Should the web client use CSRF that is passed over ajax, and just disable jsonp to ensure its always same origin? Basically, am I treating the web client security separately?</li>
  <li>How should I go about organizing the urls/app instances/subdomains or whatever is recommended to maintain the web vs mobile security? Do I just need separate url prefixes, one for mobile that uses different rules?</li>
  </ol>
  <p>I am looking for django-piston specific recommendations to solving these problems. I have already branched my project and started to play with this forked version of piston: <a href="https://bitbucket.org/jespern/django-piston-oauth2" rel="noreferrer">https://bitbucket.org/jespern/django-piston-oauth2</a></p>
  <p>One idea I had was to create a piston resource that first checks if its same-origin and then only enforces the django auth, otherwise it enforces oauth2, but I am not sure if this is even appropriate.</p>
  <h1>Update 1/1/2012</h1>
  <p>From the info that Spike provided, I started working with piston-oauth2. I ended up creating a fork of that to add some fixes for nonrel django (mongodb) and I forked someones example to also use oauth2 and piston:</p>
  <p><a href="https://bitbucket.org/justinfx/django-piston-oauth2-nonrel-example" rel="noreferrer">https://bitbucket.org/justinfx/django-piston-oauth2-nonrel-example</a></p>
  <p>Now its just a matter of me really hooking this up to my own project and getting that working. But these tests all work great.</p>