title: Best way to implement authorization in REST API's
body: <p>best way to implement authorization in REST API's developed on JERSEY Framework. For example, the following is my API end point URI and I would like to authorize so that only person access the API.</p>
  
  <p>/api/swimpool/v1/swimpool/12</p>
  
  <p>I read few article about securing REST services, but they dealt with authentication and static configuration in tomcat-users.xml in tomcat environment and little configuration in web.xml of the application. </p>
  
  <p>Token based authentication is one I came across for authorization. Are there any alternatives or best practices for securing web services.</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>How does facebook application protect there resources, for example API is there which will list/displays the photos in a given album. But how does facebook secures (authorizes) the end-points not to access other's album.</p>
  
  <p>For example, User A can view photos in his album, but can not view photos present in another user B. User <strong>A</strong> may try to guess the API (as the API is same for all the users) call being made to fetch the photos and modify the path parameters and try to fetch the details.</p>
  
  <p>Thanks</p>