title: authentication method
body: <p>I am writing a server-client application to receive user message and publish it.</p>
  
  <p>Thinking about authentication method.</p>
  
  <ol>
  <li>Asymmetric encryption,  probably RSA.</li>
  <li>Hash (salt+password+'msg'+'userid'), SHA256</li>
  <li>HMAC, SHA256. seems to be more secured than the method 2. Also involve hashing the password and msg data.</li>
  <li>Symmetric Encryption of the 'msg' with static password stored on both sides, probably AES.</li>
  </ol>
  
  <p>There is no need for encryption as the msg would be publish online anyway. So I am more lean to the HMAC or PKI method.</p>
  
  <p>I'm using java to send the request (including whatever authentication method to be implemented)
  www.mysite.com/foo?userid=12345&amp;msg=hello&amp;token=abc1234</p>
  
  <p>python on the server side to receive request and make sure the request is from the valid user.</p>
  
  <p>The problems are in integration and make sure both sides understand each other's authentication token. It is a big factor for me. And the availability of the libraries available on both language are taken into account as well.</p>
  
  <p>Or I can choose to rewrite the server side into java. (Why not python? The client side application need to be in java)</p>
  
  <p>What do you think?</p>
  
  <hr>
  
  <p>EDIT: I would not treat this as a web application. The application does not serve any webpage. Most of the operations are not related to the web. Just the client-server communication go through internet. And sending POST/GET via HTTP is what I thought of as the simpler albeit insecure way to do it. Feel free to suggest me any other alternative. </p>
  
  <p>SSL is a secure way for encryption. But it does not prevent attacker from sending message to the server impose as the user. Anyone can initiate a HTTPS connection. And the content of the communication does not need to be encrypted. It will be published online by the server anyway. What I need is a way to authenticate the message and sender.</p>
  
  <p>For now I am lean to HMAC algorithm. RSA would be more secure but it comes with more developer efforts as well. Will see how it goes.</p>
  
  <p>Thank you.</p>