Currently, I am experimenting with creating a stateless, REST-based API that I intend to use from multiple sources, one of which will be a single-page Javascript web application. The goal is to have a unified API for different clients, even those developed by others, that may require access to user data, rather than having separate APIs for each client.
The challenge I am facing now revolves around Authentication. I prefer to utilize a standard method instead of creating my own, but I am struggling to find a fitting standard solution. I also want to avoid implementing different authentication mechanisms based on the caller's identity. At this point, all I need is basic user authentication - such as username and password - for the application users. However, if other non-webpage clients wish to access it, they should also be authenticated.
After researching, it appears that using HTTP Basic authentication over an HTTPS connection might be the most effective approach. Yet, I feel like there may be something missing in this method. Other options include OAuth 1.0 - which involves sharing the Client Secret with the potentially unsecure Javascript session - or OAuth 2.0 - where the username/password are used over SSL to generate an access token, which is then utilized in future requests over SSL, similar to HTTP Basic but more obscured.
It's worth noting that I did not mention HTTP Digest due to the fact that the password sent to the server is hashed and secure, making it challenging to compare against the stored password on the backend...