RESTFUL web services used by web and native mobile apps with python authentication using the django platform

Question

I need to write RESTFUL-web services with authentication in python using the django framework that will be consumed by web clients and mobile native applications (Android and IOS).

a simple example is that the user will log in using email and password, he will extract the api key and save it on the mobile device, and then use this api key to further use the api, instead of giving the user credentials again and again.

I am thinking of using a TASTYPIE or Django piston to write RESTFUL services, but please suggest another if you know any better solution.

But my main focus is on the authentication part. Should I use OAuth to implement authentication or simple basic authentication via ssl with api-key in the response will be enough.

Answer 1

You can write a RESTful web service using the standard python library, third-party libraries are not absolutely necessary.

You should learn more about what a RESTful service defines and start implementing it yourself.

For what it's worth, I use cherrypy as a lightweight structure in several projects. It is simple and easy to use. The website even has a section on how to implement REST in your application.

Answer 2

I did this using api key exchange, as you said, and used SSL. Fine. There are a few caveats for https requests working directly on Android.

private static HttpClient newHttpClient() { KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType()); trustStore.load(null, null); SSLSocketFactory sf = new EasySSLSocketFactory(trustStore); sf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); HttpParams params = new BasicHttpParams(); HttpProtocolParams.setVersion(params, HttpVersion.HTTP_1_1); HttpProtocolParams.setContentCharset(params, HTTP.UTF_8); SchemeRegistry registry = new SchemeRegistry(); registry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80)); registry.register(new Scheme("https", sf, 443)); ClientConnectionManager ccm = new ThreadSafeClientConnManager(params, registry); return new DefaultHttpClient(ccm, params); } 

Answer 3

I used OAUTH2, which is easier to implement than OAUTH, but it needs SSL for security.

Since I used the DJANGO REST structure , you can find the setting.