title: How to secure RESTful web services?
body: <p>I have to implement secure <a href="https://www.ibm.com/developerworks/webservices/library/ws-restful/" rel="noreferrer">RESTful web services</a>. I already did some research using Google but I'm stuck.</p>
  
  <p>Options:</p>
  
  <p>TLS (HTTPS) +</p>
  
  <ul>
  <li>HTTP Basic (pc1oad1etter)</li>
  <li>HTTP Digest </li>
  <li><a href="https://stackoverflow.com/questions/4239846/2-legged-oauth-and-rest">two-legged</a> <a href="https://github.com/Mashape/mashape-oauth/blob/master/FLOWS.md" rel="noreferrer">OAuth</a></li>
  <li><a href="https://stackoverflow.com/questions/319530/restful-authentication">a Cookie-based approach</a></li>
  <li>client certificates (Tom Ritter and <a href="https://stackoverflow.com/questions/1522368/solutions-to-web-service-client-certificates-auth-best-practices">here</a>)</li>
  <li>Signed requests using <a href="http://en.wikipedia.org/wiki/HMAC" rel="noreferrer">HMAC</a> and <a href="http://s3.amazonaws.com/doc/s3-developer-guide/RESTAuthentication.html" rel="noreferrer">a limited lifetime</a></li>
  </ul>
  
  <p>Are there more possible options to consider? If OAuth then what version? Does it even matter? From what I've read so far <a href="http://tools.ietf.org/pdf/draft-ietf-oauth-v2-12.pdf" rel="noreferrer">OAuth 2.0</a> with bearer tokens (that is without signatures) seems to be <a href="http://hueniverse.com/2010/09/oauth-bearer-tokens-are-a-terrible-idea/" rel="noreferrer">insecure</a>.</p>
  
  <p>I've found another very interesting article on <a href="http://www.berenddeboer.net/rest/authentication.html" rel="noreferrer">REST based authentication</a>.</p>
  
  <p><a href="https://www.stormpath.com/blog/secure-your-rest-api-right-way" rel="noreferrer">Secure Your REST API... The Right Way</a></p>