6 ms·
I create mobile apps against a REST backend on GAE and I use just basic authentication over https for authenticating the users. I sha1 the password and compare
by zelk 14y ago
I create mobile apps against a REST backend on GAE and I use just basic authentication over https for authenticating the users. I sha1 the password and compare against a sha1 value in the database. Simplest there is but maybe not as secure as other alternatives, but I have not found any big problems with this. Please tell me if I am missing something vital. Have bought a book about OAuth but have not opened it yet. :)
- hussfelt 14y agoI was aiming more for app <-> app authentications more than app <-> user authentication, but in your case I would definitely use at least a salt for your sha1 hashed passwords. oAuth seems to have quite a large pool of samples and classes here which I found useful; http://oauth.net/code/ http://oauth.net/code/
- breathesalt 14y agoRead: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/ Since you're running on GAE you're likely using either python or java: Python bcrypt implementation: http://www.mindrot.org/projects/py-bcrypt/ http://www.mindrot.org/projects/py-bcrypt/ Java bcrypt implementation: http://www.mindrot.org/projects/jBCrypt/ http://www.mindrot.org/projects/jBCrypt/