title: Calling a REST web service secured with Spring Security from Android
body: <p>I'm hosting a REST web service in a Grails application, using Spring Security, i.e.:</p>
  
  <pre><code>@Secured(['IS_AUTHENTICATED_REMEMBERED'])
  def save = {
      println "Save Ride REST WebMethod called"
  }
  </code></pre>
  
  <p>I'm calling it from an Android app.  (Calling the unsecured service works just fine.)</p>
  
  <p>To call the service, I'm manually building up a request (<code>HttpUriRequest</code>) and executing it with an <code>HttpClient</code>.</p>
  
  <p>I'm wondering what the best practices are, and how to implement them... Specifically, should I: </p>
  
  <ol>
  <li>Perform a login once, to retrieve a JSESSION_ID, then add a header containing it into the HttpUriRequest for each subsequent request?</li>
  <li>Or (not sure how I would even do this) include the login and password directly on each request, foregoing the cookie/server-side session</li>
  </ol>
  
  <p>I think I can get option 1 working, but am not sure if Spring Security permits (2), if that's the way to go...  Thanks!</p>
  
  <p>--also, there isn't any library I'm missing that would do all this for me is there? :)</p>