title: REST HTTP Authentication - How?
body: <p>So, I'm developing a REST webservice using RESTeasy and Google App Engine. My question isn't related to GAE, but I mentioned it just in case it matters. It happens that naturally I need to secure my resources and my own users (not Google's).</p>
  
  <p>Securing a REST webservice seems like a very controversial subject, or at least a very 'liberal' one. REST doesn't impose any standard on this matter. From what I've researched on the web and literature, there are at least 3 approaches that I think might fit in my application:</p>
  
  <ul>
  <li><strong>HTTP Basic</strong> (with SSL)</li>
  <li><strong>HTTP Digest</strong> (with SSL)</li>
  <li><strong>OAuth</strong></li>
  </ul>
  
  <p>OAuth seems like the most complete approach. But I don't think that such a complexity is needed because I will not need to authorize any 3rd party applications. It is a webservice to be consumed by my own client applications only.</p>
  
  <p><strong>HTTP Basic</strong> and <strong>HTTP Digest</strong> appear as the most simple ones on the web, but the fact is that I've never found a concrete implementation of them using RESTeasy, for example.
  I've found <a href="http://docs.jboss.org/resteasy/docs/2.3.0.GA/userguide/html/Securing_JAX-RS_and_RESTeasy.html" rel="noreferrer">this page</a> and <a href="http://docs.jboss.org/resteasy/docs/2.3.0.GA/userguide/html/Authentication.html" rel="noreferrer">this one</a> in RESTeasy's documentation. They are indeed very interesting, but they tell little or nothing on this subject (HTTP Basic or Digest).</p>
  
  <p>So, here I am asking:</p>
  
  <p><em>How do I secure my WebService using HTTP Basic or Digest in RESTeasy?</em></p>
  
  <p>Perhaps it is so simple that it isn't worth mentioning in the documentation or anywhere else?
  Also, if anyone can provide me some insight on the matter of securing RESTful webservices, it could be helpful. </p>
  
  <p><em>Am I choosing the right approaches?</em></p>