title: RESTful application security
body: <p>I have written a C++ application framework which communicates with a server app, using a RESTful API. The data passed between the client and server is currently using a (32bit long) simple password that is known (hardcoded) in both server and client.</p>
  
  <p>In my current scheme, the data transfer between client and server is done as a binary encoded data. The data is a zipped JSON format string that has been encrypted using a password (as mentioned above).</p>
  
  <p>I am aware that this is possibly, the weakest form of security. I would like to beef up the security by using HTPPS as well as some other mechanism so that each client has a unique token which cant be faked - even by anyone who may happen to be eavesdropping to the messages. This is very important, since sensitive personal and financial data will be transferred between the server and the client, so any security breaches can be considered to be fatal.</p>
  
  <p>Can anyone please outline a strategy/methodology (or best practise) to implement such a security - including, if I have to do anything else to use HTTPS instead of HTTP - incidentally (may seem a dumb question), but what extra security does HTTPS offer over HTTP in such a scheme as the one I have described above?</p>
  
  <p>I am particularly interested in:</p>
  
  <ol>
  <li>RESTful authentication/authorization</li>
  <li>Securely dealing with each client - so that the server can identify attempts by rogue clients attempting to "pretend" to be another client. For example, instanceA of the child app should NOT be able to masquerade as instanceB for example.</li>
  </ol>