REST Web Service - Website authentication

Question

I have been working on a service that allows registered users to store data and retrieve it using an JavaScript XML Request. Basically, my service has one part that receives that product details and one part that returns them as XML on request.

What I am trying to do is prevent people from accessing other users product details. So if one user was to post product details to my service under the username "randomUser65" from website "www.example.com", then another person that tries to access the same product details user "randomuser95" and website www.tryingtostealproductdetails.com" can't get accesss.

Is there any way that JavaScript can be used to achieve this by some means of website authentication that cannot be replicated by someone trying to steal that another users data?

Thank You for your help.

Best Regards, The_Lorax

Answer 1

A very simple way of doing this is to provide every user with an authentication key they would provide in every request they make to your service. This key would have to be long and random enough so that it cannot be guessed easily.

Answer 2

Think about Yahoo auth or Google auth : they have, like Altherac said, an API Key for each user.

http://developer.yahoo.com/faq/#appid

http://code.google.com/intl/fr-FR/apis/maps/signup.html