title: How exactly to implement challenge-response for REST API authentication?
body: <p>I want my REST API server to be able to communicate only with my iOS app. The user base is going to be no more than 1000 people, and the market is pretty small and unpopular in general. That's why I think anything beyond a simple challenge-response authentication (HTTP, OAuth 2.0, SSL) would be an overkill. But I'm not sure exactly how this auth should flow. Here is what I have in mind:</p>
  
  <ul>
  <li>Client app (user) sends a request: api.example.com/auth?username=john</li>
  <li>Server responds with a randomly generated string: "somerandomlygeneratedstring"</li>
  <li>Client takes the string, appends it to the username and then appends a secret string, hard coded in the app and uses MD5 to hash the entire string.</li>
  <li>Client passes the string to the server: api.example.com/auth?username=john&amp;response=thenewMD5hashstring</li>
  <li>Server generates the same MD5 hash string and if they match, marks this user as authenticated in the database and all API requests from this user will be handled from now on.</li>
  </ul>
  
  <p>Do I have the right idea? Or am I totally wrong? Please have in mind, I want basic security, anything too fancy would be an overkill for such a small project.</p>
  
  <p>Also, I'm not keeping any sensitive data on my database like personal information.</p>