title: REST API Token-based Authentication
body: <p>I'm developing a REST API that requires authentication. Because the authentication itself occurs via an external webservice over HTTP, I reasoned that we would dispense tokens to avoid repeatedly calling the authentication service. Which brings me neatly to my first question:</p>
  
  <p><strong>Is this really any better than just requiring clients to use HTTP Basic Auth on each request and caching calls to the authentication service server-side?</strong></p>
  
  <p>The Basic Auth solution has the advantage of not requiring a full round-trip to the server before requests for content can begin. Tokens can potentially be more flexible in scope (i.e. only grant rights to particular resources or actions), but that seems more appropriate to the OAuth context than my simpler use case.</p>
  
  <p>Currently tokens are acquired like this:</p>
  
  <pre><code>curl -X POST localhost/token --data "api_key=81169d80...
                                       &amp;verifier=2f5ae51a...
                                       &amp;timestamp=1234567
                                       &amp;user=foo
                                       &amp;pass=bar"
  </code></pre>
  
  <p>The <code>api_key</code>, <code>timestamp</code> and <code>verifier</code> are required by all requests. The "verifier" is returned by:</p>
  
  <pre><code>sha1(timestamp + api_key + shared_secret)
  </code></pre>
  
  <p>My intention is to only allow calls from known parties, and to prevent calls from being reused verbatim.</p>
  
  <p><strong>Is this good enough? Underkill? Overkill?</strong></p>
  
  <p>With a token in hand, clients can acquire resources:</p>
  
  <pre><code>curl localhost/posts?api_key=81169d80...
                      &amp;verifier=81169d80...
                      &amp;token=9fUyas64...
                      &amp;timestamp=1234567
  </code></pre>
  
  <p>For the simplest call possible, this seems kind of horribly verbose. Considering the <code>shared_secret</code> will wind up being embedded in (at minimum) an iOS application, from which I would assume it can be extracted, is this even offering anything beyond a false sense of security?</p>