title: PhoneGap authentication pattern against Grails backend
body: <p>I'm developing a backend service in Grails that should serve both a web application and a mobile application.</p>
  
  <p>The frontend is being developed using AngularJS and the mobile app will use the same AngularJS codebase to go native with PhoneGap.</p>
  
  <p>Now, I'm looking for a proper way to implement the authentication with the Grails backend that works both for the web app and mobile app.</p>
  
  <p>Three ideas:</p>
  
  <p>1) Store username and password in LocalStorage and authenticate the user on the backend at every request</p>
  
  <p>2) Use cookie based authentication (it's tricky to enable cookies in PhoneGap, I should 
  extract from the AJAX response and attach in the AJAX request)</p>
  
  <p>3) Develop a custom protocol that generates a token for every session in the backend and stores that in LocalStorage. The session token will be sent in every request to the backend.</p>
  
  <p>4) Sign every request using a private/public key mechanism (similar to Amazon AWS). Even in this case, the backend has to verify the correctness of the signature for every request (there is not a session concept).</p>
  
  <p>I don't trust the LocalStorage so much but I have no other ideas and I can't find any example (an example with other backend and frontend technologies would help the same).</p>
  
  <p>You can assume that the backend will run on HTTPS.</p>