title: Rest API security for mobile apps
body: <p>I'm in the process of designing a mobile application that will need to connect to a server-side process for its business logic and data transactions.  I'm writing my server-side code in Java using Spring Boot and I intend to create a Rest API in order for the mobile app to connect to the server.</p>
  
  <p>I'm just doing some research at the moment for the best way to secure the connection between mobile app and server.  What I'd like to do is allow the user on the mobile app to log in once they open the app and for them to use the app for as long as they like and for their access to time out after a period of inactivity.</p>
  
  <p>Can anyone recommend any very simple reading on this?  I've looked at OAuth2 but that appears to be for logging into web services using another account (like Google, GitHub, etc).</p>
  
  <p>Would it be acceptable to login over https (SSL) by passing username and password to a rest endpoint and returning some sort of token (a GUID?).  Then have the client (mobile app) pass that GUID with each subsequent call so the server can verify the call?  Is it better to just do everything over SSL in this scenario?</p>
  
  <p>I have done a fair bit of research but I don't seem to be able to find anything that quite matches what I'm trying to do.</p>
  
  <p>Hope someone can help</p>
  
  <p>Thanks</p>