CODEWITHSUNDEEP
google-app-enginerestoauth
Dominik
Dominik

Reputation: 599

Build a REST WebService with GAE using OAuth

I'm about to build a community platform from scratch. We are going to create the WebServices first and the community might have some third party components, so having solid WebServices is a good idea anyway.

Since the service is stateless we need authentication for every single call. Is it a good idea to implement the OAuth protocol for our service provider to perform this task although we are the only consumer right now?

By the way: We will deliver a mobile application before a website is launched.

Upvotes: 1

Views: 996

Answers (2)

Michele Orsi
Michele Orsi

Reputation: 762

From my experience I created the REST WS in a authentication agnostic way: jersey methods accept everything, then there are several filters in order to validate the requests. I used OpenId authentication for the web part, OAuth and BASIC AUTHENTICATION (with SSL) for API.

Probably it is not needed to create everything from the beginning, but remember to de-couple as much as possible your REST endpoint from the authentication: you will have a great benefit when you want to release APIs.

Last "philosophical" thing: OAuth is not totally stateless, in fact you have a temporary token that authenticates a user and it is similar to a session in the browser!

Upvotes: 0

Peter Knego
Peter Knego

Reputation: 80340

The whole point of OAuth is to allow other websites (consumers) to get access to your data (you are the provider). Since you are the only consumer of your data, there is no need to implement OAuth at this stage of development.

Be lean, build something fast and put it in front of users/testers. Only at this point you will discover real bugs and get a feedback on the service so that you can improve it and steer the development in the right direction.

Note: OAuth as provided by App Engine (second paragraph) only supports users with Google Accounts (even if OpenID is used).

Upvotes: 1

Related Questions