title: How can I implement user authentication for ColdFusion Web Services called from a mobile application?
body: <p>I am developing several Web Services that will be accessed by a mobile application. I have several requirements:</p>
  
  <ol>
  <li>Each user will need to sign in with their own User ID and Password (the same User ID and Password they use to sign into the website).</li>
  <li>Every Web Service request will need to be authenticated to ensure that the request is coming from the mobile app(s).</li>
  <li>Every Web Service request will need to authenticate the user, since there is user-specific fucntionality built in, and access will need to be blocked if the user's account is disabled.</li>
  </ol>
  
  <p>Let's assume that OAuth is not an option.</p>
  
  <p>In order to ensure that Web Service requests are coming only from the mobile app(s), I am planning to use HTTP Basic Authentication in IIS (the mobile app(s) will need to have a User Account setup in Windows Server and the mobile app will need to store the User Name &amp; Password and pass these in the header).</p>
  
  <p>Next is the User Authentication for each Web Service request. Would it be suitable to encrypt the User ID, Password, and some shared secret key (a "pepper", of sort) with AES-256, pass that encrypted string as a parameter with each request (over HTTPS, of course), and then decrypt and parse it on the server to authenticate? This is the existing plan, but something just doesnt seem right about it - like it's not "secure enough".</p>
  
  <p>What else can I do to properly authenticate users for Web Service requests?</p>