I want to implement a custom user authentication system in my appengine app. I don't want to use sessions. I'm a newbie in this area, so I have two basic questions:
1: Is it secure to just send a username and password with every single RPC over https? What do I need to do to keep that username and password secure on the client end?
2: How do I tell GWT to use https when it makes its requests?
I don't know much about security, so please don't spare me any "obvious" details.
Thanks!
On GAE you can also use Google User Services API http://code.google.com/appengine/docs/java/users/overview.html . It's very intuitive and you won't need to know security details.
Watching the process with firebug shows that all RPCs are happening over the same protocol that the host page was requested with. This seems to be required for same-site-origin rules, so I'm going to assume that my answers are
1: Yes, but it's slower
2: GWT automatically uses https when the host page was requested w/ https