How to extend a Zend Framework application to allow RESTful authentication?

Question

I have a Zend Framework application that I am trying to tweak so I can use with an iPhone application. Everything in my ZF application requires that you are logged in first.

In the browser you go to myapp.com/auth/login and get a login form. When you successfully authenticate, a cookie is set in order to remember that you are logged in (I think that's how it works). It also redirects you to the home page and displays HTML.

Ideally, my iPhone app will authenticate (somehow) against my ZF app and get a JSON response. Then it can make future requests as being authenticated. So far, my iPhone application sets the login credentials as the POST data and submits to the login page, and the ZF app returns the HTML of the home page (or the validation failed page).

I'm looking for some "best practices" answers to this. Maybe I'm asking the wrong question. Maybe I don't need to be thinking about "RESTful authentication". What is the best way to approach tweaking my Zend Framework application to allow my iPhone app to authenticate and make requests?

Answer 1

Maybe you could implement a two-leg OAuth authentication between you iPhone application and your ZF application.

You could see more information here:

http://hueniverse.com/2008/10/beginners-guide-to-oauth-part-iii-security-architecture/

http://oauth.net/

Other than that, there is always the alternative of manually passing the cookie values back to the server. That should be enough:

1. Get the headers of the POST response
2. Extract the cookies from the header and save them somewhere
3. When you perform a secondary request to the server you add the cookie headers manually

I think that should do it.