Security and authentication in web services

Question

Lets say we have a website that uses a web service for all of its functionality (i.e. retrieving and updating data from/to db), how does the web service authenticate requests?

As I understand it, in a traditional java "website" a user provides a username & password, and upon validation a jsessionid is assigned to the user (client browser). Every time the client browser asks the website for something, the site checks for the jsessionid ensuring that the user is registered and authenticated. Is there a web services equivalent of this? If yes, what?

Answer 1

Usually for web services the most easy solution is using Basic Authentication. For something more complex, "Api Key\Token" are passed with each request to authorize\authenticate the users. Another solution is OAuth.

Twitter for example use Basic Authentication and OAuth.

Answer 2

The web service world is governed by the ws-* standards.

See WS-Security:

• http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=wss
• http://en.wikipedia.org/wiki/WS-Security

The wikipedia article gives a nice high-level overview, oasis is the official home of the standards, and provides the detailed specifications.

Answer 3

Does your web service even need to be publically accessible?

You might not need to worry about complicated authentication schemes if there is no reason to allow public traffic from even reaching the web service.

Answer 4

This link should give you a good introduction. Look through chapters 4 through 6. HTH.