How to implement two level authentication in a RESTful API?
问题 I am writing a RESTful API for a fairly complex web application (further referred as api.mywebapp.com) The requirements include that api.mywebapp.com should handle: API level authentication (authorizing client application eg.: mobile app) User level authentication (authorizing www.mywebapp.com registered users so they can access their protected resources) Usage example: Mobile application connects to the https://api.mywebapp.com with a valid basic HTTP authorization header (Authorization: