title: RESTful Authentication of mobile clients via Spring MVC
body: <p>I'm trying to figure out what is the best way to secure my Spring MVC controllers (which uses only json).
  I've followed many questions (for example <a href="https://stackoverflow.com/questions/10826293/restful-authentication-via-spring">RESTful Authentication via Spring</a>).
  My problem though seems to be quite a common use case but I didn't find a concrete answer for it.</p>
  
  <p>Requirements:</p>
  
  <ol>
  <li>All communication is made from mobile clients (Android/iPhone) using json.</li>
  <li>A user can login using facebook (client side authentication with facebook sdk), which means there is no password to send to the server.</li>
  <li>BASIC authentication is not desired, as there is no password and i'd rather the client to sliently login.</li>
  <li><strong>IMPORTANT</strong> there is no registration screen as I want to ease up on my users, when a user login (facebook/email) the server creats on the fly a user inside the DB, in case of facebook I'm not asking the user anything as he already authenticated with facebook sdk locally, as for email, the server asks the user to put his password as he might using someone's else email.</li>
  </ol>
  
  <p>I'm in particular struggling on implementing step 4, probably going to use Spring Security as my server heavily uses Spring anyway.</p>