Securing REST and JSON
authorization, rest, ruby-on-rails, security
Solution
The fact that it's RESTful or uses JSON isn't a relevant factor when it comes to securing a web service. Any web service would need to be secured in the same manner. There are a few things you should do:
- If possible, don't host your web service on the Internet. If the web service is hosted within your company's LAN, for example, it won't be exposed to public consumption unless you specifically exposed it through your router.
- Set up authentication and authorization rules. If you're hosting your web service inside of a Windows domain, you could simply use Windows authentication and set up rules based on Active Directory users and groups. Other options are to use HTTP authentication, client certificate authentication, or if you're developing in .NET, forms authentication.
- Use encryption (HTTPS), especially if your web site is hosted on the Internet.
Problem
I want to build my web services serving JSON data utilizing RESTful architecture. But I want my own client apps only that can request from my web services. Basically, my web services contain sensitive data that is not for public consumption, but I wanted to build it that way so I can build many different client apps that connects to my web service. Would appreciate any ideas for this, thanks.